{
 "id": "WPSEC-2026-2474",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2474/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2474/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2474/index.md",
 "title": "Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 4.1.0 - Unauthenticated Limited File Upload via Testimonial Submission Form",
 "description": "The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to limited file uploads via the classic testimonial submission form in all versions up to, and including, 4.1.0. This is due to the form handler passing every submitted file field to media_handle_upload(), relying only on the MIME type the client supplies, even when the form does not show an image field. This makes it possible for unauthenticated attackers to upload files of any type WordPress allows (such as PDF, office or media files) to the media library and attach them to submitted testimonials.",
 "plugin": {
  "slug": "testimonial-free",
  "name": "Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials",
  "full_name": "Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials",
  "wordpress_org": "https://wordpress.org/plugins/testimonial-free/",
  "advisories_url": "https://wpsec.com/vuln/plugin/testimonial-free/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/testimonial-free"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "4.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 4.1.1"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "4.1.1",
 "remediation": "Update to 4.1.1 or later.",
 "fix_released": "2026-11-03T12:44:04+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:57:22.184400+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2474/",
  "https://plugins.svn.wordpress.org/testimonial-free/tags/4.1.1/",
  "https://wordpress.org/plugins/testimonial-free/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/testimonial-free",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}