The Baggage Freight Shipping Australia plugin allows any user to submit a file to the upload-package.php endpoint without validation. An attacker can send a POST request with a malicious file that the plugin then moves directly to its upload directory. Because the file is executed by the web server, this flaw permits unrestricted execution of arbitrary code on the affected WordPress site.

WordPress sites that have the Shipster Baggage Freight Shipping Australia plugin version 0.1.0 installed are affected. The vulnerability is limited to installations running this specific plugin version, which places the plugin’s upload directory in a web‑accessible location.

The CVSS score of 9.3 indicates critical severity, and the EPSS score is not available, meaning current exploit probability data is lacking. The vulnerability is listed as not in the CISA KEV catalog. Attackers only need network access to the WordPress site; no authentication or privileged access is required. By sending a crafted file to the unprotected endpoint, an attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the entire host.