The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_a…

The GutenBee Gutenberg Blocks plugin for WordPress contains an arbitrary file upload vulnerability in versions up to 2.20.1. The vulnerability exists in the gutenbee_file_and_ext_json function due to a flawed strpos() substring check that only verifies if a filename contains '.json' rather than confirming it ends with a .json extension. This allows attackers to upload files with double extensions like shell.json.php to bypass validation. Authenticated attackers with author-level access or higher can exploit this to upload executable files, potentially leading to remote code execution on the affected WordPress site.