The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads because the save_qr_code_to_db() function does not validate file types before storing them. An attacker can submit any file via the plugin’s upload interface, and because no authentication is required, this can lead to remote code execution if a malicious script is uploaded and executed on the server. The vulnerability is a classic server‑side file upload flaw (CWE‑434).

The affected vendor is Ajitdas, whose Flex QR Code Generator WordPress plugin, all releases up to and including version 1.2.5, is impacted. Any WordPress site that has this plugin installed and has not applied the newer version is vulnerable.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score of less than 1 % indicates that, at present, the probability of exploitation is low, but the potential impact is severe: an unauthenticated attacker could gain file‑write privileges and possibly execute code. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely exploit the upload endpoint by sending a crafted payload, possibly a PHP file, to achieve remote code execution.