WordPress Anton Extensions Plugin Arbitrary File Upload RCE Vulnerability

The Anton Extensions WordPress plugin through 1.2.2 contains an arbitrary file upload vulnerability. Before writing attacker-supplied content to an attacker-chosen path, the plugin fails to perform several security checks:

• No capability check
• No nonce verification
• No file-type validation

As a result, unauthenticated attackers can upload arbitrary PHP files and achieve remote code execution.