The vulnerability stems from the Embed PDF for WPForms plugin’s ajax_handler_download_pdf_media function, which lacks file type validation. This omission allows an authenticated user with Subscriber-level access or higher to upload any file type. Once on the server, a malicious file could be executed, leading to remote code execution. The weakness is categorized as CWE‑434, which is a file upload flaw that permits execution of arbitrary code.

The affected product is the Embed PDF for WPForms plugin developed by salzano. All releases up to and including 1.1.5 of the plugin are vulnerable. The flaw is exploitable on WordPress installations that have the plugin installed and allow Subscriber accounts (or higher) to use the PDF upload feature.

The CVSS score of 8.8 marks this issue as High severity. However, the EPSS score is reported as lower than 1%, indicating a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the attack requires legitimate Subscriber credentials and exploitation occurs via an AJAX endpoint, the risk is mitigated by the need for authenticated access but remains significant if such accounts exist on the site. Proper restriction or patching is advised to eliminate the threat.