Some vulnerabilities have been reported in the Nmedia Users File Uploader plugin for WordPress, where one has an unknown impact and the other can be exploited by malicious people to compromise a vulnerable system.

1) An unspecified error exists. Currently there is no further information available.

2) The wp-content/plugins/nmedia-user-file-uploader/js/uploadify/uploadify.php script allows upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerabilities are reported in versions prior to 1.8.

Solution
Update to version 1.8.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://wordpress.org/extend/plugins/nmedia-user-file-uploader/changelog/

Deep Links
Links available to Secunia VIM customers