CVE-2024-7257: 
WordPress vulnerability analysis and mitigation

The YayExtra – WooCommerce Extra Product Options plugin for WordPress contains a critical vulnerability (CVE-2024-7257) that affects all versions up to and including 1.3.7. The vulnerability was discovered and disclosed on August 3, 2024, and involves arbitrary file uploads due to missing file type validation in the handleuploadfile function (NVD).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434) with a CVSS v3.1 score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue stems from inadequate file type validation in the handleuploadfile function, which fails to properly verify uploaded file types (Wordfence).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution. This presents a severe security risk as attackers could gain unauthorized access to the server and execute malicious code (NVD).

The vulnerability has been patched in version 1.3.8 of the YayExtra plugin, released on August 1, 2024. Users are strongly advised to update to this version or later to protect their installations. The update includes proper file type validation to prevent arbitrary file uploads (WordPress Plugin).