Are you aware of hidden link
Hello there,
Thanks for your contact.
We have just released the Toolset Types version 3.4.18, with a fix for this "vulnerability" issue. You can download the latest Toolset Types plugin from your account's page: https://toolset.com/account/downloads/, or you can install/update Toolset plugins using the installer plugin - please click on "Check for updates" button: - https://toolset.com/faq/how-to-install-and-register-toolset/#automatic-installation-once-you-have-otgs-installer-plugin-installed
Regards,
Mateus.
Thank you. I am updating all sites as we speak.
But why do you say [this "vulnerability" issue]? You are not convinced it's a vulnerability?
Hi there,
Thanks for your reply.
Sorry for not explaining this well before. So, here are our findings about the issue:
We had several reports about the possible vulnerability in Types (seems that it just went public in Plesk, linking back to patchstack): hidden link
This report has limited details, but unless there is something extra, it appears to be a non-issue. Because it says that administrators can upload arbitrary files, presumably that relates to the File field type, for uploading and storing files. Editing a post and uploading files to the file field uses the WordPress Media Uploader, and it determines the allowable file types (mostly images, videos, audio, and documents), which excludes executables like .php files. Therefore, this is not arbitrary.
Site administrators can override this by setting the constant ALLOW_UNFILTERED_UPLOADS to true in wp-config.php. Absent further details, it doesn't appear to be a vulnerability from our perspective.
I hope that everything is clear now. Thank you!
My issue is resolved now. Thank you!
My sites are registered. I'm not seeing the 3.4.18 version as available. (none of the sites I use it on show an update available)
Is this only for uploads that don't have file types designated for an upload field?
