CVE-2024-7384

Name of the Vulnerable Software and Affected Versions AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions up to, and including, 9.7.2

Description The issue is related to arbitrary file uploads due to missing file type validation in the acym extractArchive function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions up to, and including, 9.7.2, update to a version higher than 9.7.2 to resolve the issue. As a temporary workaround, consider disabling the acym extractArchive function until a patch is available. Restrict access to the plugin's file upload functionality to minimize the risk of exploitation. Avoid using the plugin's file upload feature until the issue is resolved.