The Auto Thumbnailer plugin for WordPress allows authenticated attackers with Contributor level access or higher to upload arbitrary files to the site’s server because the uploadThumb() function performs no file type validation. If an attacker uploads a malicious script, remote code execution may be achieved, leading to full compromise of the affected WordPress installation.

ModernTribe’s Auto Thumbnailer plugin running on WordPress sites. All releases up to and including version 1.0 are affected; no later release information is provided in the advisory.

The CVSS score of 8.8 classifies this flaw as a high severity vulnerability, and the EPSS score of less than 1% indicates a low probability of active exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and have Contributor or higher privileges to exploit the flaw. The lack of file type restrictions enables uploading of potentially executable files, which can then be accessed to run arbitrary code on the server. No mitigations beyond a patch are documented, so the risk remains until a proper fix is applied.