WordPress · My Account Page Editor · CVE-2023-4536
**Name of the Vulnerable Software and Affected Versions**
My Account Page Editor WordPress plugin versions prior to 1.3.2
**Description**
The issue allows any authenticated users to upload arbitrary files to the server, leading to remote code execution (RCE). This is due to the lack of validation for the profile picture to be uploaded.
**Recommendations**
For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities for authenticated users, especially subscribers, until the update is applied.