High · published December 13, 2025
⚡ Authenticated users can upload any file they want — no validation checks in the WP3D Model Import Viewer plugin! This is a recipe for disaster! 🔥 Think of it like a restaurant that lets patrons swap out the ingredients in any dish without any oversight; one rogue chef could serve up something truly toxic! An attacker with Author-level access could potentially upload malicious files, leading to remote code execution. This means they could completely take over the server, access sensitive data, or even deface the site — absolutely devastating!
Think of it like a restaurant that lets patrons swap out the ingredients in any dish without any oversight; one rogue chef could serve up something truly toxic! The vulnerability lies in the handle_import_file() function, which lacks proper file type validation, allowing any file to be uploaded by authenticated users, such as scripts or executables.
An attacker with Author-level access could potentially upload malicious files, leading to remote code execution. This means they could completely take over the server, access sensitive data, or even deface the site — absolutely devastating! Immediately update the WP3D Model Import Viewer plugin to version 1.0.8 or later to patch this vulnerability. Additionally, review user permissions to limit access to trusted users only. Implement strict file type validation to further secure your site. You can handle this! Act quickly, and your site will be secure again in no time. 🛡️