SoftClever Limited Sync Posts Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in the SoftClever Limited Sync Posts WordPress plugin, specifically in versions through 1.0. This vulnerability could be exploited to upload a web shell to the web server.

Impact

Exploitation of this vulnerability could lead to arbitrary file upload, allowing attackers to upload malicious files such as web shells, which could then be executed to gain further access to the website.

Remediation

Users are advised to remove and replace the Sync Posts WordPress plugin, as it has not been updated in over a year and is unlikely to receive future updates or fixes. Patchstack has issued a virtual patch to mitigate this vulnerability for users who subscribe to their service.