In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Remote Code Execution (RCE)/Arbitrary File Upload in wpForo Forum

One of the changelog entries for version 1.6.5 of wpForo Forum is:

Fixed Bug: Don’t allow admins upload other file types in XML Phrases importer form. Security issue: Remote Code Execution (RCE) “Arbitrary File Upload”.

In looking into this that referred to something accessible to those logged in by users that would normally have the capability to do the equivalent of the security issue there. There is check for a valid nonce when doing that, so there isn’t a cross-site request forgery (CSRF) issue either.