CVE-2023-7201: 
WordPress vulnerability analysis and mitigation

The Everest Backup WordPress plugin before version 2.2.5 contains a file upload vulnerability that affects high-privilege users such as administrators. This security issue was assigned CVE-2023-7201 and was publicly disclosed on March 25, 2024 (WPScan).

The vulnerability stems from improper validation of backup files during the upload process. When uploading backup files through the plugin's 'Restore' section, the plugin fails to properly validate the file types, allowing administrators to upload arbitrary files to the server even in scenarios where this should be restricted, such as in multisite setups. The vulnerability can be exploited by manipulating the Content-Disposition header during file upload to change the file extension (WPScan).

The vulnerability allows high-privilege users to upload arbitrary files to the server, potentially leading to code execution if PHP files are uploaded. This is particularly concerning in multisite WordPress installations where such capabilities should be restricted (WPScan).

The vulnerability requires an authenticated administrator account to exploit. A proof of concept exists demonstrating how an attacker can upload a file with a .ebwp extension and then modify the Content-Disposition header to change the extension to .php, allowing for arbitrary code execution (WPScan).

Users should upgrade to Everest Backup version 2.2.5 or later, which contains fixes for this vulnerability (WPScan).