Echo RSS Feed Post Generator WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Echo RSS Feed Post Generator plugin for WordPress, affecting all versions through 5.4.8.1. The issue arises from inadequate file type validation in the echo_generate_featured_image() function, enabling unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the uploaded files possibly being executed remotely, depending on the file type and server configuration.