Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 4.1.0 - Unauthenticated Limited File Upload via Testimonial Submission Form
- ID
- WPSEC-2026-2474
- Plugin
- Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials (testimonial-free)
- Affected
- from 3.0.0 before 4.1.1
- Remediation
- Update to 4.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-434
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials on WPSec AttackSurface
- Fix released
- Published
Description
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to limited file uploads via the classic testimonial submission form in all versions up to, and including, 4.1.0. This is due to the form handler passing every submitted file field to media_handle_upload(), relying only on the MIME type the client supplies, even when the form does not show an image field. This makes it possible for unauthenticated attackers to upload files of any type WordPress allows (such as PDF, office or media files) to the media library and attach them to submitted testimonials.
References
- https://wpsec.com/vuln/WPSEC-2026-2474/
- https://plugins.svn.wordpress.org/testimonial-free/tags/4.1.1/
- https://wordpress.org/plugins/testimonial-free/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS