A critical arbitrary file upload vulnerability in the LightSync Pro plugin for WordPress allows authenticated attackers to execute malicious code on the host server.

The plugin contains a vulnerability in the rest_replace_media() function that fails to validate file types during upload. This flaw allows an authenticated attacker with low privileges to upload arbitrary files, potentially leading to remote code execution.

Successful exploitation of this vulnerability could result in a complete compromise of the WordPress site. An attacker may upload web shells or malicious scripts, leading to unauthorized data access, site defacement, or the use of the server as a pivot point for further network attacks. Given the CVSS score of 8.8, this poses a significant risk to organizational security and business continuity.

Immediate Action: Update the LightSync Pro plugin to version 2.1.7 or the latest available version provided by the vendor to implement proper file validation.

Proactive Monitoring: Review server logs for unusual POST requests directed at the WordPress REST API or unexpected file creation events in the media upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file extensions or unauthorized REST API calls to the vulnerable plugin functions.

Public Exploit Available: Unknown

The high severity of this vulnerability necessitates immediate attention. Administrators should verify the current version of LightSync Pro in use and apply the vendor patch immediately. If an update is not immediately feasible, consider temporarily deactivating the plugin to prevent potential exploitation.