Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions , CVE-2024-1169

CVE, Research URL: CVE-2024-1169
Home page URL: Security reports for Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Application: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Published on: Mar 07, 2024
Research Description: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to upload media files.
Affected versions: Min -, max 2.8.8.
Status: vulnerable

Post Form &#8211; Registration Form &#8211; Profile Form for User Profiles &#8211; Frontend Content Forms for User Submissions , CVE-2024-1169