Input validation vulnerability in Specialist *

The Specialist theme for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery. This type of attack can allow unauthenticated attackers to upload malicious files to the website, even if the website is secured. This is because the upload-file.php file does not have the necessary protection called a “nonce”, which is used to prevent malicious requests. An attacker can trick a website administrator into clicking a link which would then allow the malicious files to be uploaded.