The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_a…

The GutenBee Gutenberg Blocks plugin for WordPress versions up to 2.20.1 contains an arbitrary file upload vulnerability. The flaw exists in the gutenbee_file_and_ext_json function due to improper validation using strpos() that only checks if '.json' exists in the filename rather than verifying it ends with .json extension. This allows attackers to upload files with double extensions like shell.json.php to bypass validation. Authenticated attackers with author-level access or higher can exploit this to upload executable files, potentially leading to remote code execution.