title: Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload
description: The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: Simple Schools Staff Directory
vendor: Unknown
versions:
lessThanOrEqual: 1.1, status: affected, version: 1.1, versionType: custom
}