Executive Summary

This vulnerability exists in the Enable SVG, WebP, and ICO Upload plugin for WordPress up to version 1.1.2. It allows authenticated users with author-level access or higher to upload arbitrary files due to insufficient validation of ICO file types. Specifically, files with double extensions and correct magic bytes can bypass sanitization and be accepted as valid ICO files, potentially enabling remote code execution on the server.

Useful 0 Not Useful 0

Impact Analysis

An attacker with author-level access or above can exploit this vulnerability to upload arbitrary files to the server hosting the WordPress site. This can lead to remote code execution, allowing the attacker to execute malicious code, compromise the server, steal data, or disrupt the website's operation.

Useful 0 Not Useful 0