The vulnerability in the Download From Files plugin enables unauthenticated attackers to upload arbitrary files through the AJAX fileupload action. By POSTing to admin-ajax.php with action download_from_files_617_fileupload and manipulating allowExt, an attacker can trick the plugin into accepting executable files like PHP shells. This allows execution of code on the server, compromising confidentiality, integrity, and availability.

WordPress sites running the Download From Files plugin version 1.48 or older are impacted. The plugin is distributed through the WordPress plugin repository and is widely used. Users of older iterations lack the upload restrictions added in later releases. No specific WordPress version is required; the flaw resides solely in the plugin.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, but the lack of listed KEV suggests it has yet to be widely exploited in the wild. The attack vector is remote, relying on unauthenticated HTTP POST requests to the site’s admin-ajax.php endpoint. If the plugin remains installed and enabled, an attacker can upload a PHP shell without authentication, leading to full remote code execution.