Authenticated (Author+) Arbitrary File Upload in Starter Templates

An Author-level user can bypass the WXR importer’s filename check to upload arbitrary files (including PHP) into wp-content/uploads, enabling remote code execution. Affects Starter Templates plugin versions up to 4.4.41; fixed in 4.4.42 by enforcing wp_check_filetype-based extension and MIME validation in the importer’s allow-list.

This vulnerability affects the following application versions:

• Starter Templates – AI-Powered Templates 0.4.4.0
• Starter Templates – AI-Powered Templates 0.4.4.15
• Starter Templates – AI-Powered Templates 4.2.2
• Starter Templates – AI-Powered Templates 4.2.3
• Starter Templates – AI-Powered Templates 4.2.4
• Starter Templates – AI-Powered Templates 4.2.5
• Starter Templates – AI-Powered Templates 4.2.6
• Starter Templates – AI-Powered Templates 4.3.0
• Starter Templates – AI-Powered Templates 4.3.1
• Starter Templates – AI-Powered Templates 4.3.2
• Starter Templates – AI-Powered Templates 4.3.3
• Starter Templates – AI-Powered Templates 4.3.4
• Starter Templates – AI-Powered Templates 4.3.5
• Starter Templates – AI-Powered Templates 4.3.6
• Starter Templates – AI-Powered Templates 4.3.7
• Starter Templates – AI-Powered Templates 4.3.8
• Starter Templates – AI-Powered Templates 4.3.9
• Starter Templates – AI-Powered Templates 4.4.0
• Starter Templates – AI-Powered Templates 4.4.1
• Starter Templates – AI-Powered Templates 4.4.2
• Starter Templates – AI-Powered Templates 4.4.3
• Starter Templates – AI-Powered Templates 4.4.4
• Starter Templates – AI-Powered Templates 4.4.5
• Starter Templates – AI-Powered Templates 4.4.6
• Starter Templates – AI-Powered Templates 4.4.7
• Starter Templates – AI-Powered Templates 4.4.8
• Starter Templates – AI-Powered Templates 4.4.9
• Starter Templates – AI-Powered Templates 4.4.10
• Starter Templates – AI-Powered Templates 4.4.11
• Starter Templates – AI-Powered Templates 4.4.12
• Starter Templates – AI-Powered Templates 4.4.13
• Starter Templates – AI-Powered Templates 4.4.14
• Starter Templates – AI-Powered Templates 4.4.16
• Starter Templates – AI-Powered Templates 4.4.17
• Starter Templates – AI-Powered Templates 4.4.18
• Starter Templates – AI-Powered Templates 4.4.19
• Starter Templates – AI-Powered Templates 4.4.20
• Starter Templates – AI-Powered Templates 4.4.21
• Starter Templates – AI-Powered Templates 4.4.22
• Starter Templates – AI-Powered Templates 4.4.23
• Starter Templates – AI-Powered Templates 4.4.24
• Starter Templates – AI-Powered Templates 4.4.25
• Starter Templates – AI-Powered Templates 4.4.26
• Starter Templates – AI-Powered Templates 4.4.27
• Starter Templates – AI-Powered Templates 4.4.28
• Starter Templates – AI-Powered Templates 4.4.29
• Starter Templates – AI-Powered Templates 4.4.30
• Starter Templates – AI-Powered Templates 4.4.31
• Starter Templates – AI-Powered Templates 4.4.32
• Starter Templates – AI-Powered Templates 4.4.33
• Starter Templates – AI-Powered Templates 4.4.34
• Starter Templates – AI-Powered Templates 4.4.35
• Starter Templates – AI-Powered Templates 4.4.36
• Starter Templates – AI-Powered Templates 4.4.37
• Starter Templates – AI-Powered Templates 4.4.38
• Starter Templates – AI-Powered Templates 4.4.39
• Starter Templates – AI-Powered Templates 4.4.40
• Starter Templates – AI-Powered Templates 4.4.41