mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

Description

The plugin does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution.