Several WP Cloud Plugins for WordPress are vulnerable to arbitrary file upload, allowing authenticated attackers with subscriber-level access to achieve remote code execution.

The vulnerability exists in the download_file_to_uploads function, where the import action fails to perform a capability check via can_import() and does not validate file extensions or contents against allowed MIME types. This allows authenticated attackers with subscriber-level access or higher to upload executable files to the server.

The ability for an attacker to perform remote code execution poses a severe risk to the confidentiality, integrity, and availability of the entire WordPress environment. With a CVSS score of 8.8, this flaw could lead to total system compromise, unauthorized data access, or the deployment of persistent backdoors, significantly impacting business operations and data security.

Immediate Action: Update all affected WP Cloud Plugins to version 3.9.0 or later to ensure the missing capability checks and file validation logic are applied.

Proactive Monitoring: Monitor server logs for unexpected file uploads in the uploads directory or unusual script executions originating from plugin-related directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter out suspicious file upload attempts or block requests targeting the import action of these plugins until updates can be applied.

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Given the high CVSS severity and the potential for full system compromise, organizations using these WP Cloud Plugins must prioritize the update to version 3.9.0. Security teams should audit user permissions to ensure that subscriber-level accounts are restricted where possible, limiting the potential attack surface for this and similar vulnerabilities.