WordPress Snazzy Social Media Feed Plugin Arbitrary File Upload Vulnerability

The Snazzy Social Media Feed plugin for WordPress is vulnerable to an Arbitrary File Upload in all versions up to and including 2.5.

The flaw exists in the standalone save-to-cache.php script, which is directly reachable without loading WordPress. Missing WordPress bootstrap, authentication, capability, and nonce checks, combined with insufficient sanitization of the pluginURL parameter, allow the value to be written to a web-executable PHP file.

• Affected versions: all versions up to and including 2.5
• Attackers need subscriber-level access or above
• Uploaded files may be executable, leading to remote code execution
• FILTER_SANITIZE_URL preserves characters needed for a PHP payload, written verbatim to cached-content/cached-feed.php and executable via a single GET request