CVE-2021-24123: 
WordPress vulnerability analysis and mitigation

CVE-2021-24123 is a vulnerability discovered in the PowerPress WordPress plugin affecting versions before 8.3.8. The vulnerability was identified on October 11, 2020, and involves an arbitrary file upload issue in the plugin's feed image handling functionality, specifically in the Podcast Artwork section (WPScan).

The vulnerability stems from improper verification of uploaded feed images in the PowerPress plugin. The issue is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD CNA). The vulnerability allows high-privilege accounts (admin+) to upload arbitrary files, including PHP files, which can lead to Remote Code Execution (RCE) (WPScan).

The vulnerability enables authenticated users with administrative privileges to upload arbitrary files to the server, potentially leading to Remote Code Execution (RCE). This could allow attackers with admin access to execute malicious code on the affected WordPress installation (WPScan).

The vulnerability requires authentication with administrative privileges to exploit. A proof of concept exists demonstrating the exploitation process through the Blubrry PowerPress Settings > Feeds section, where an attacker can upload malicious PHP files disguised as images (WPScan).

The vulnerability has been patched in PowerPress version 8.3.8. Users are strongly advised to update their PowerPress plugin to this version or later to mitigate the risk (WPScan).