CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
The Smart Auto Upload Images plugin for WordPress contains an unrestricted file upload vulnerability in versions up to 1.2.0. An authenticated user with low privileges can upload arbitrary files to the server without proper validation. This allows attackers to upload malicious code, potentially gaining full control of the site. All users should update immediately.
What an attacker can do
Upload arbitrary files (including PHP code) to the server and execute them.
Potential impact on your site
Attackers with basic user accounts can run their own code on your site, steal data, or take it offline.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber role).
Key dates
External resources
