WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload

2024-01-0500:00:00

wpscan.com

wordpress

plugin

arbitrary file upload

vulnerability

unauthenticated

remote code execution

AI Score

8.2

Confidence

Low

EPSS

0.001

Percentile

39.1%

JSON

Description The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.