CVE-2023-0477: 
WordPress vulnerability analysis and mitigation

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin versions before 3.9.16 contained a security vulnerability identified as CVE-2023-0477. The vulnerability was discovered and publicly disclosed on February 14, 2023. This security issue affects WordPress installations using the affected plugin versions (WPScan, NVD).

The vulnerability stems from an AJAX endpoint implementation that contains incorrect file extension validation. This security flaw has been assigned a CVSS score of 7.2 (High). The technical issue allows users with Author-level privileges or higher to upload arbitrary files, including potentially malicious PHP files, to the server (Wordfence, WPScan).

The vulnerability enables authenticated users with Author privileges to upload arbitrary files to the WordPress installation's uploads directory. This capability could potentially be exploited to upload malicious PHP files, leading to remote code execution on the affected website (WPScan).

The vulnerability can be exploited by authenticated users with Author privileges through the plugin's media library interface. A proof of concept exists demonstrating the exploitation process, which involves manipulating the AJAX endpoint using specific API credentials and JavaScript code execution in the browser console (WPScan).

The vulnerability has been patched in version 3.9.16 of the Auto Featured Image plugin. Website administrators running affected versions should immediately update to the latest version to mitigate this security risk (WPScan).