The WP移行専用プラグイン for CPI plugin for WordPress allows unauthenticated users to upload arbitrary files because the Cpiwm_Import_Controller::import function lacks file type validation. This flaw meets CWE‑434 and can enable attackers to place malicious code on the server. If an attacker uploads a PHP script or other executable content, the web server could execute it, giving full control over the site.

The vulnerability affects kddiwebcommunications' WP移行専用プラグイン for CPI plugin for all releases up to and including version 1.0.2. These instances are commonly deployed on WordPress installations where the import feature is enabled.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score of less than 1% suggests a low yet non‑zero likelihood of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Because the upload endpoint is reachable without authentication, an attacker can directly exploit the flaw by uploading a malicious file and executing it on the server. The lack of an official patch keeps the risk high for any site still running the affected plugin version.