SuperStoreFinder Plugins - Unauthenticated Arbitrary File Upload

Description

The SuperStoreFinder premium WordPress plugins did not properly check file uploads, depending on the plugin, only checking for the mime type and/or the first extension of the file name.

An attacker could set the Content-Type header to "Content-Type: text/csv", as well as use a double extension to bypass the checks in place, allowing arbitrary files to be uploaded.

The original advisory mentioned a Cross-Site Request Forgery (CSRF) vulnerability, however there was no need to use a CSRF attack as the request could be sent as an unauthenticated user.

According to the changelog, it appears that the plugin recently underwent a Penetration Test. It is possible that the patch from the penetration test was reverse engineered to create an exploit and posted to the PacketStorm repository.