Ebook Store WordPress Plugin Arbitrary File Upload Vulnerability Allowing Unauthenticated Access

A vulnerability exists in the Ebook Store plugin for WordPress, affecting all versions through 5.8012. The issue arises from inadequate file type validation in the 'ebook_store_save_form' function, allowing unauthenticated users to upload arbitrary files to the server. This could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the possibility of executing malicious code on the server.

Reproduction

The vulnerability can be reproduced by uploading a file through the Ebook Store plugin's form upload feature. The absence of proper file type validation allows for the upload of files that could be executed as code on the server.

Remediation

Users are advised to update the Ebook Store plugin to version 5.8013 or later.