This is the technical support forum for Toolset - a suite of plugins for developing WordPress sites without writing PHP.
Everyone can read this forum, but only Toolset clients can post in it. Toolset support works 6 days per week, 19 hours per day.
No supporters are available to work today on Toolset forum. Feel free to create tickets and we will handle it as soon as we are online. Thank you for your understanding.
All my sites that. use toolset are listed as WARNINGS:
Category:PLUGIN
Versions-Affected:<= 3.4.17
Type:Upload
Severity:HIGH
Description:Dave Jong (Patchstack) discovered and reported this Arbitrary File Upload vulnerability in WordPress Types Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website.
We had several reports about the possible vulnerability in Types (seems that it just went public in Plesk, linking back to patchstack): hidden link. So, here are our findings about this issue:
This report has limited details, but unless there is something extra, it appears to be a non-issue. Because it says that administrators can upload arbitrary files, presumably that relates to the File field type, for uploading and storing files. Editing a post and uploading files to the file field uses the WordPress Media Uploader, and it determines the allowable file types (mostly images, videos, audio, and documents), which excludes executables like .php files. Therefore, this is not arbitrary.
Moreover, site administrators can override this by setting the constant ALLOW_UNFILTERED_UPLOADS to true in wp-config.php. Absent further details, it doesn't appear to be a vulnerability from our perspective.
We have already released a new version for Types 3.4.18, which includes a fix for this "vulnerability". You can update either from the downloads page, or may need to click the "Check for updates" button in Plugins -> Add New -> Commercial tab.
I hope that everything is clear and solved now. Thank you!
Thanks for all this explanation. I looked at my website and it just says it has the latest version. Since you have updated the plugin, how long will it show that there is an updated so I can update it with your latest. I don't know how to update it otherwise. Thank you.
