Patchstack: Pre-Auth Arbitrary File Upload in User Submitted Posts Plugin

Joseph Abear

October 21, 20231 min read

Patchstack: Pre-Auth Arbitrary File Upload in User Submitted Posts Plugin

The "User Submitted Posts" plugin, a popular tool for user-generated content in WordPress, had a vulnerability that allowed unauthenticated users to upload arbitrary files. The potential risk was remote code execution. The issue was resolved in the plugin version 20230914. To prevent this from occurring, users should update to at least this version. Plugin developers can make use of Patchstack's security audit services and Threat Intelligence Feed API. Best practice to avoid similar vulnerabilities includes implementing a check on filename and extension before uploading, as well as applying a whitelist of allowed file extensions. Users of Patchstack Developer and Business are already protected from this vulnerability and can sign up for the Patchstack Community plan for notifications about vulnerabilities. Read the original article.

Written by

Joseph Abear

Tagged:WordPress Security

Explore a website growth scenario

Change the assumptions to see how traffic and inquiries affect the estimated lifetime revenue of customers acquired in one month. The starting values are examples. This calculator does not measure lost revenue or predict what a redesign will achieve.

Monthly website visitors

Use the same monthly period for visitors and leads.

Monthly website leads

Use distinct inquiries attributable to those visitors.

Leads that qualify (%)

Your own estimate of the share that fits your business.

Qualified leads that become customers (%)

Use your observed rate or label it as an assumption.

Lifetime revenue per customer ($)

Revenue across the customer relationship, before costs.

Assumed change in traffic (%)

A scenario you choose, not a prediction from Stoute.

Assumed conversion change (percentage points)

For example, adding 1 point changes a 2% conversion rate to 3%.

One month’s acquired customers

Customers under current assumptions: 3.0
Customers in your scenario: 3.0
Current cohort’s estimated lifetime revenue: $3,000
Scenario cohort’s estimated lifetime revenue: $3,000
Difference across those customers’ lifetimes: $0

Visitor-to-lead rate: 2.0% → 2.0%. Scenario conversion is limited to 0–100%. Fractional customers represent an average, not a literal customer count.

These amounts are gross lifetime revenue, not monthly cash flow, profit, or return on investment. The model holds qualification, close rate, and customer value constant. It excludes project costs, advertising, delivery costs, and payment timing.

Have a specific WordPress improvement in mind? Describe it in a written inquiry.

Keep Reading