WPtouch 3.4.5 Shell Upload Vulnerability

Hi Tim,

With version 3.4.3 we revised how WPtouch authenticates file uploads. Where we had previously been relying on an admin nonce, since that version, the plugin’s file uploads (icons, web app mode startup screens) can only be performed by a logged in user with administrative privileges.

Absent further information from the reporter, we do not believe there is any significant vulnerability identified in yesterday’s report.

However, out of an abundance of caution, we will be including a patch in release 3.4.7 which aggressively limits the types of files that can be uploaded through WPtouch.

Thanks,

Martin Kuplens-Ewart
Product Designer
WPtouch