CVE-2024-4345

Name of the Vulnerable Software and Affected Versions Startklar Elementor Addons plugin for WordPress versions up to, and including, 1.7.13

Description The issue is related to arbitrary file uploads due to insufficient file type validation in the process function in the startklarDropZoneUploadProcess class. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions up to, and including, 1.7.13, update to a version later than 1.7.13 to resolve the issue. As a temporary workaround, consider disabling the process function in the startklarDropZoneUploadProcess class until a patch is available. Restrict access to the startklarDropZoneUploadProcess class to minimize the risk of exploitation.