WordPress Crossword Compiler Puzzles Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in the WordPress Crossword Compiler Puzzles plugin, affecting versions through 5.2. This vulnerability could be exploited to upload a web shell to a web server.

Impact

Exploitation of this vulnerability could lead to arbitrary file upload, allowing attackers to upload malicious files such as web shells that could be executed to gain further access to the website.

Remediation

Users of the WordPress Crossword Compiler Puzzles plugin should update to version 5.3 or later. Patchstack users can enable auto-update for vulnerable plugins.