Wp Cloud Plugins Box Lets Box
Monthly
Arbitrary file upload in WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, and Lets-Box/Box) versions 2.0 through 3.8.3 lets attackers with subscriber-level access write executable files to the WordPress uploads directory, enabling remote code execution (CVSS 8.8). The vulnerable download_file_to_uploads function is reachable through an import AJAX action that is also registered via wp_ajax_nopriv_ and lacks a capability check in can_import(), so the effective authentication prerequisite may be lower than the CVSS PR:L rating suggests, though exploitation still requires one of the four plugins installed and active and depends on the host allowing PHP execution inside wp-content/uploads. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file upload in WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, and Lets-Box/Box) versions 2.0 through 3.8.3 lets attackers with subscriber-level access write executable files to the WordPress uploads directory, enabling remote code execution (CVSS 8.8). The vulnerable download_file_to_uploads function is reachable through an import AJAX action that is also registered via wp_ajax_nopriv_ and lacks a capability check in can_import(), so the effective authentication prerequisite may be lower than the CVSS PR:L rating suggests, though exploitation still requires one of the four plugins installed and active and depends on the host allowing PHP execution inside wp-content/uploads. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV.