Input validation vulnerability in Annonces 1.2.0.1

The Annonces plugin for WordPress is vulnerable to a security risk in some versions. In versions up to and including 1.2.0.1, there is missing file type validation in a file called ‘theme.php’. This means that people who do not have permission to access the website can upload files to the website’s server. If these files are malicious, it can allow the attacker to run code on the website remotely.