OptimizePress (WordPress theme) vulnerability found, actively being exploited

(Just trying to get the word out to OptimizePress users as I haven’t gotten a reply from OptimizePress and I don’t see coverage of this exploit anywhere else yet. Mods – if this is the wrong forum, please correct me. I looked for rules/guidance but couldn’t find any.)

The OptimizePress “coming soon image” file upload utility is publicly accessible (does not require WP admin authentication) and does not perform any checking of file type. This allows hackers to find vulnerable sites via Google and upload PHP files to a known location, in most cases allowing them to take over the site.

I wrote full details on my blog: WordPress OptimizePress hack (file upload vulnerability).