Install plugin by upload file not check file type

[mix5003]

Upload installs of plugins not check file type. If hacker bruteforce or get admin level access, they can run php script on my site.

To reproduce:

1. Upload a php file via Plugins->Add New->Upload after upload it ask ftp login detail. please leave it and do 2.
2. Use browser goto ​http://mysite/wp-content/uploads/[CURRENT YEAR]/[CURRENT MONTH]/filename.php

[michalzuber]

Reproduced ​https://youtu.be/DUCGtevodFA

[michalzuber]

Blocked php file upload both on local and on live, too ​http://i.imgur.com/UlmXKED.png
ZIP upload was successfull, too.

[mix5003]

Replying to michalzuber:

Blocked php file upload both on local and on live, too ​http://i.imgur.com/UlmXKED.png
ZIP upload was successfull, too.

sorry i test in my production server and it work. i guess some plugin in my production server allow zip file for upload

[michalzuber]

Replying to mix5003:

Replying to michalzuber:

Blocked php file upload both on local and on live, too ​http://i.imgur.com/UlmXKED.png
ZIP upload was successfull, too.

sorry i test in my production server and it work. i guess some plugin in my production server allow zip file for upload

It worked for me as described, it should be OK. Had no issues.

[DrewAPicture]

This seems to have been ruled invalid and never closed.