The EM Beer Manager plugin for WordPress contains a flaw where the EMBM_Admin_Untappd_Import_image() function does not validate the type of files that can be uploaded, and the accompanying AJAX endpoint lacks proper authorization checks. This allows a user with subscriber-level access or higher to upload any file, including PHP scripts, and subsequently execute code on the web server, assuming the attacker can supply a mock HTTP server that returns the expected JSON payload. The vulnerability therefore enables remote code execution for authenticated users.

WordPress sites running the EM Beer Manager plugin version 3.2.3 or earlier, maintained by Erin Morelli. Versions up to and including 3.2.3 are impacted; sites using any newer release are presumed unaffected.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Because an attacker must be authenticated and possess at least subscriber privileges—and must also coordinate a mock HTTP server that provides specific JSON data—the attack vector is authenticated remote code execution with non‑trivial prerequisites, reducing its ease of exploitation.