Executive Summary

This vulnerability exists in the WP Dispatcher plugin for WordPress, where the function wp_dispatcher_process_upload() does not properly validate file types. This allows authenticated users with Subscriber-level access or higher to upload arbitrary files to the server hosting the WordPress site. Although there is an .htaccess file that limits remote code execution, the vulnerability could still potentially allow attackers to execute malicious code remotely.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with low-level authenticated access to upload arbitrary files, which may lead to remote code execution on the server. This can compromise the security and integrity of the affected website, potentially leading to data breaches, defacement, or further exploitation of the server.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the WP Dispatcher plugin to a version later than 1.2.0 where the issue is fixed. Additionally, restrict or review user permissions to limit Subscriber-level access and above from uploading files until the update is applied. Consider implementing additional file upload validation or security measures on your server to prevent arbitrary file uploads.

Useful 0 Not Useful 0