CVE-2024-5807: 
WordPress vulnerability analysis and mitigation

The Business Card WordPress plugin through version 1.0.0 contains a security vulnerability that allows high-privilege users, such as administrators, to upload malicious PHP files. This vulnerability was assigned CVE-2024-5807 (WPScan, NVD).

The vulnerability exists in the file upload functionality of the Business Card WordPress plugin. It lacks proper file type validation controls, allowing administrators to upload PHP files through the plugin's admin interface at '/wp-admin/admin.php?page=es-bcard-options&cat=2'. This vulnerability can be exploited by sending a specially crafted multipart/form-data request containing a malicious PHP file (WPScan).

If exploited, this vulnerability could allow authenticated administrators to execute arbitrary PHP code on the server, potentially compromising the entire WordPress installation. This impact extends to MultiSite configurations, potentially affecting multiple websites hosted on the same server (WPScan).

The vulnerability requires an authenticated administrator account to exploit. A proof of concept exists demonstrating how to upload malicious PHP files through the plugin's admin interface using browser console commands (WPScan).