Vulnerabilities and security researches forswiss-toolkit-for-wp swiss-toolkit-for-wp

Jun 07, 2024

CVE, Research URL: CVE-2024-5204
Home page URL: Security reports for Swiss Toolkit For WP
Application: Swiss Toolkit For WP
Date: May 29, 2024
Research Description: The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and above permissions to log in as any existing user on the site, such as an administrator.
Affected versions: max 1.0.8.
Status: vulnerable

Apr 03, 2025

CVE, Research URL: CVE-2025-31546
Home page URL: Security reports for Swiss Toolkit For WP
Application: Swiss Toolkit For WP
Date: Mar 31, 2025
Research Description: Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.0.
Affected versions: max 1.4.1.
Status: vulnerable

CVE, Research URL: CVE-2025-31544
Home page URL: Security reports for Swiss Toolkit For WP
Application: Swiss Toolkit For WP
Date: Mar 31, 2025
Research Description: Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.5.
Affected versions: max 1.4.6.
Status: vulnerable

Jul 13, 2026

CVE, Research URL: CVE-2026-2354
Home page URL: Security reports for Swiss Toolkit For WP
Application: Swiss Toolkit For WP
Date: Jul 11, 2026
Research Description: The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Affected versions: max 1.4.6.
Status: vulnerable