WordPress Fluent Forms cloud storage plugin: unauthenticated arbitrary file write

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/{driver}/save and /download/single-file REST endpoints, combined with insufficient path validation in the Google Drive downloadFile() function, where the Google Drive metadata name value is concatenated into a local path without basename(), sanitize_file_name(), or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended downloads directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.