What the vulnerability does
01Description
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
Explanation of Vulnerability in Simple Terms
02Summary
The Benaa Framework contains an unrestricted file upload vulnerability affecting versions up to 4.0.0. An authenticated user with low privileges can upload arbitrary files to the server without proper validation. This allows attackers to upload malicious code, potentially gaining control of the site. The vulnerability requires valid user credentials but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server and execute malicious code on the site.
Potential impact on your site
04Site Impact
Attackers with basic user accounts can upload and run malicious code, compromising site integrity and confidentiality.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
May 2, 2025
CVE published
April 8, 2026
Record updated
