BeeTeam368 WordPress Plugin Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in the BeeTeam368 Extensions plugin for WordPress, specifically in versions through 2.3.5. The issue arises from inadequate file type validation in the handle_submit_upload_file() function, allowing authenticated users with Subscriber-level access or higher to upload arbitrary files to the server. This vulnerability could potentially be exploited for remote code execution.

Impact

Exploitation of this vulnerability could lead to arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

Users are advised to update the BeeTeam368 Extensions plugin to version 2.3.6 or a newer patched version.