Sammy Forgit has discovered a vulnerability in the Xerte Online plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/xerte-online/xertefiles/save.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability has been confirmed in version 0.32. Other versions may also be affected.
Vulnerable Products
Vulnerable Software: Xerte Online 0.x (plugin for WordPress)
