title: Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload
description: The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Unknown
product: ZYREX POPUP
versions:
status: affected, versionType: custom, version: 0, lessThanOrEqual: 1.0
defaultStatus: affected
collectionURL: https://wordpress.org/plugins
}