Copypress Rest API Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Copypress Rest API plugin for WordPress, affecting versions 1.1 through 1.2. The issue arises because the plugin uses a hard-coded JWT signing key when no secret is provided, and it fails to validate which file types can be uploaded as attachments. This allows unauthenticated attackers to forge a valid token, gain elevated privileges, and upload arbitrary files, such as PHP scripts, through the image handler, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.