title: Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
description: The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Unknown
product: Asgaros Forum
versions:
status: affected, versionType: semver, version: 0, lessThan: 2.7.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}