CVE-2015-9271

An unauthenticated remote attacker can upload a file with an extension like ".phtml" or ".Php.shtml" to a WordPress site running the vulnerable plugin. The plugin's upload script, `vc/vw_upload.php`, only checks if the last four characters of the filename are within an allowed list, and a basic check for ".php" can be bypassed. This allows for remote code execution if the server is configured to interpret such files as executable.

The vulnerability exists in the file `videowhisper-video-conference-integration/vc/vw_upload.php`. The script processes uploaded files, and its validation logic for file extensions is flawed. It checks the last four characters of the filename and has a bypassable check for ".php".

The advisory indicates that the vulnerability was not properly fixed in previous attempts, and the patch was insufficient. The vendor guidance suggests that the file extension check needs to be more robust to prevent malicious file uploads. Specifically, the check `if (strstr($filename,'.php')) exit;` is insufficient, and the extension validation `if (in_array($ext,$allowed))` does not adequately prevent files with executable content from being uploaded.