The Qyrr – simply and modern QR-Code creation plugin for WordPress contains a flaw in the blob_to_file() routine that fails to validate uploaded file types. An authenticated user with Contributor or higher privileges can submit any file, thereby gaining the ability to place executable content on the web root. This creates a potential vector for remote code execution if the attacker uploads a crafted script or webshell. The issue relies on missing server-side validation, a classic case of unsafe file upload practice.

WordPress sites that have installed wpchill’s Qyrr – simply and modern QR-Code creation plugin version 2.0.7 or earlier are affected. The vulnerability resides within the plugin’s core upload logic, so any site using those versions, regardless of other themes or plugins, is at risk.

The CVSS score of 6.4 indicates a moderate risk, while the EPSS score is below 1% and the flaw is not listed in CISA’s KEV catalog. The attack vector requires authentication; any user with Contributor-level role or higher can trigger the flaw. Once an arbitrary file is uploaded, an attacker may achieve remote code execution depending on server configuration. As long as contributors retain access to the upload functionality, the threat remains realistic for affected sites.