WordPress AF Companion Plugin Arbitrary File Upload

The AF Companion WordPress plugin, versions prior to 2.2.0, has a vulnerability in its import feature. It does not validate the type of files uploaded, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones.

This can lead to Remote Code Execution, a serious security risk.