Critical · published September 19, 2025
🚨 A simple missing capability check is the gateway for attackers! With just one unauthorized upload, they can drop malicious files into your WordPress site. 🔥 Think of it like a charity event with a sign-in sheet that nobody actually checks. Anyone can waltz in and start setting up their own booth, even if they’re selling completely fake merchandise! If exploited, an attacker could upload malicious web shell files disguised as legitimate plugins, leading to complete remote code execution. This means they could take over your site, steal sensitive information, or even hijack your entire server! It's absolutely devastating when a charity's goodwill is undermined by such a breach.
Think of it like a charity event with a sign-in sheet that nobody actually checks. Anyone can waltz in and start setting up their own booth, even if they’re selling completely fake merchandise! The vulnerability arises from the 'beplus_import_pack_install_plugin' function in the Goza theme, which fails to properly check user capabilities before allowing arbitrary file uploads. This oversight permits unauthenticated users to upload zip files containing harmful scripts.
If exploited, an attacker could upload malicious web shell files disguised as legitimate plugins, leading to complete remote code execution. This means they could take over your site, steal sensitive information, or even hijack your entire server! It's absolutely devastating when a charity's goodwill is undermined by such a breach. Patch to version 3.2.3 or later immediately to close this vulnerability. Additionally, review all uploads and restrict file types to mitigate future risks. Consider implementing security plugins that monitor and filter uploads! You've got this! Stay vigilant and secure your site with these updates! 🛡️