The AIO Forms plugin for WordPress allows administrators to import form configurations through a zip upload. The plugin lacks file type validation during import, enabling authenticated users with Administrator permissions to upload files of any type. This flaw, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), can be leveraged to place malicious code on the web server, potentially leading to remote code execution.

WordPress sites using the AIO Forms – Craft Complex Forms Easily plugin versions 1.3.18 and earlier are affected. Administrators or users with higher privileges on these sites can exploit the weakness.

The CVSS score of 7.2 indicates a high impact vulnerability. However, the EPSS score is below 1%, suggesting a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need administrator access and the ability to navigate to the import function to upload a crafted file; no external interface is required. Once uploaded, malicious files could be executed by accessing them through the web server, giving attackers code execution capabilities.