Description
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| https://adsanityplugin.com/ | AdSanity | < 1.8.2 | 1.8.2 |
Advisories 1
- WID-SEC-2023-2617 Xen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2025