CVE-2023-51411

The vulnerability of type CWE-434 (Unrestricted Upload of File with Dangerous Type) results from the lack of proper verification of the type and content of uploaded files on the server side. An attacker without any authentication can upload a file with a dangerous extension (e.g., PHP) through the frontend form handling mechanism provided by the plugin. Once the malicious file is placed on the server, the attacker can then execute its contents, gaining remote control of the server.

An attacker can gain the ability to execute arbitrary code (RCE) on the server hosting the vulnerable WordPress installation, which can consequently lead to complete server compromise, data theft, installation of backdoors, and further lateral movement within the infrastructure.

The Frontend Admin by DynamiApps plugin should be immediately updated to a version higher than 3.18.3, in accordance with information available from the vendor and in the Patchstack database. Until the update is applied, it is recommended to disable the plugin. It is also advisable to conduct a file audit on the server to detect any potentially already uploaded malicious files.

The WordPress Frontend Admin by DynamiApps plugin (acf-frontend-form-element) in versions from its initial release through 3.18.3 inclusive.