The Responsive Filterable Portfolio plugin allows an authenticated attacker with Administrator privileges to upload arbitrary files through the HdnMediaSelection_image field because the plugin does not validate the file type. This flaw can enable attackers to place malicious scripts or executables on the server, potentially leading to remote code execution.

WordPress sites that have the Responsive Filterable Portfolio plugin by nik00726 installed in any version up to and including 1.0.24 are affected. Users who can authenticate as administrators or higher are able to exploit the flaw.

The vulnerability has a CVSS score of 7.2, indicating moderate to high severity, and an EPSS score of less than 1%, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog. The attack requires legitimate administrator access; once the attacker can upload a file, they can place code in a web‑accessible location, potentially achieving remote code execution if the server executes uploaded files.