WordPress Popular Posts < 5.3.3 - Authenticated Code Injection

Description

Jerome Bruandet from NinTechNet discovered a code injection issue in the plugin before 5.3.3: "When thumbnails settings are set to 'Custom field name' and 'Resize image from Custom field' (they aren’t by default), a user with contributor role or above can bypass the file type verification, download a remote PHP script to the server and execute it."