Hustle WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Hustle WordPress plugin, specifically in versions through 7.8.9.2. This issue arises from improper file type validation in the action_import_module() function. As a result, authenticated attackers with lower-privileged roles, such as Subscribers, can upload arbitrary files to the server. Such uploads may facilitate remote code execution. Exploitation of this vulnerability requires an admin to grant Hustle module permissions to the low-privileged user, enabling access to the Hustle admin page and the necessary nonce.

Impact

Exploitation of this vulnerability could lead to arbitrary file uploads, potentially allowing for remote code execution on the affected server.

Remediation

Users are advised to update the Hustle WordPress plugin to version 7.8.9.3 or a newer patched version.