title: Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
description: The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: Classyfrieds
vendor: Unknown
versions:
lessThanOrEqual: 3.8, status: affected, version: 3.8, versionType: custom
}