Input validation vulnerability in Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme 2.9.3

The Page Builder: KingComposer plugin for WordPress is vulnerable to a security issue in which unauthorized users can upload files to the server. This vulnerability affects versions up to 2.9.3, and is caused by a function called ‘process_bulk_action’ found in the ‘kingcomposer/includes/kc.extensions.php’ file. This security issue allows users with author level permissions and higher to upload any type of file to the server, which can be used to run code on the server.