The flaw permits an unauthenticated attacker to send an HTTP POST request to the MStore API plugin’s REST‑API endpoint and upload any file. By uploading a PHP file with an arbitrary name the attacker can execute code on the host, giving complete control over the site. This is a classic arbitrary file upload vulnerability (CWE‑306), which directly leads to remote code execution.

The vulnerability resides in the MStore API WordPress plugin, version 2.0.6. All WordPress sites running this exact plugin version are affected. No other versions are listed as affected by the CNA. The product is identified under the vendor "mstore".

The CVSS score of 9.3 signals a critical risk. EPSS is not reported, but the absence of authentication and the ability to upload executable files mean that an attacker with web access can compromise the server. The vulnerability is not yet in CISA’s KEV catalog. The likely attack vector is web‑based: a malicious actor submits a crafted POST to the /config_file endpoint, bypasses authentication checks, and receives server‑side execution of the uploaded file.