Career Section WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the Career Section plugin for WordPress, affecting all versions through 1.7. The issue arises from inadequate file type validation in the CV upload handler, enabling unauthenticated attackers to upload potentially executable files, which could lead to remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary file upload, with the potential for uploaded files to be executed on the server, leading to remote code execution.

Reproduction

To reproduce this vulnerability, upload a file through the CV upload feature of the Career Section plugin version 1.7 or earlier. The absence of proper file type validation allows the upload of executable files.

Remediation

Users are advised to update the Career Section plugin to version 1.8 or later.