A critical file upload vulnerability in the zportals WordPress plugin permits authenticated attackers to execute arbitrary code on the underlying server.

The plugin exhibits an unrestricted file upload vulnerability (CWE-434) by trusting client-supplied content types and failing to sanitize file extensions. This allows any authenticated user, including those with low-level subscriber privileges, to upload malicious PHP scripts.

With a CVSS score of 8.1, this vulnerability represents a severe threat to the entire hosting environment. Successful exploitation grants an attacker the ability to execute arbitrary code, potentially leading to full server compromise, unauthorized data access, and lateral movement within the network.

Immediate Action: Update the zportals plugin to version 6.3.4 or later immediately.

Proactive Monitoring: Audit the file upload directories for the presence of unexpected PHP files or scripts with suspicious naming conventions.

Compensating Controls: Restrict permissions on web-accessible upload directories to prevent the execution of scripts, and utilize a WAF to inspect and block file upload requests containing suspicious extensions.

Public Exploit Available: Yes, a public Proof-of-Concept is available.

The risk of remote code execution necessitates immediate patching. Administrators should verify that all user accounts are properly managed and limit the exposure of file upload features until the update is applied.