HS Brand Logo Slider 2.1 allows authenticated WordPress administrators to upload arbitrary files by bypassing client‑side validation on the logoupload parameter. An attacker can rename the uploaded file to a .php extension and submit it, resulting in PHP code execution on the server. The weakness is an instance of Unrestricted File Upload (CWE‑434) and can compromise confidentiality, integrity, and availability of the affected site.

The vulnerability affects all WordPress sites that have Heliossolutions' HS Brand Logo Slider plugin version 2.1 installed. No other vendors or product versions are listed as impacted.

The CVSS score of 8.7 reflects a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, meaning it has not been officially reported as a known exploit yet. However, the attacker must have administrative privileges to the WordPress backend to perform the upload, which limits the attack surface to authenticated users. Because the flaw enables remote code execution with moderate effort, the risk remains significant for sites running the vulnerable plugin.