The Astra Security Suite – Firewall & Malware Scan plugin for WordPress allows unauthenticated users to upload arbitrary files through the plugin’s remote zip download feature. Insufficient validation of the remote URL and a guessable key in all releases up to 0.2 enable attackers to place executable files on the server, which can subsequently allow remote code execution. The weakness corresponds to CWE‑285: Improper Privileges.

Any WordPress installation running Astra Security Suite – Firewall & Malware Scan version 0.2 or earlier is vulnerable. The issue exists in all releases through including 0.2. Users of later community or paid tiers are not affected as the upload capability was removed or patched.

The CVSS base score of 8.1 indicates high impact, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can abuse the plugin’s upload endpoint from any network location; authentication is not required to trigger the flaw, so the attack surface covers the entire public web server.