The Smart Auto Upload Images plugin for WordPress lacks file type validation in its auto‑image creation feature, allowing authenticated users with Contributor-level access or higher to upload arbitrary files. If a malicious file is placed in the plugin’s upload directory and executed by the web server or application, remote code execution can be achieved, compromising the entire site.

The vulnerability affects the Smart Auto Upload Images – Import External Images plugin (burhandodhy) version 1.2.0 and any earlier releases. It is installed on WordPress sites that host the plugin as any user with Contributor or greater roles can exploit the flaw.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% shows a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker must first obtain valid Contributor-level credentials or compromise such an account through other means. Once authenticated, the attacker can upload a malicious file into the plugin’s upload folder, potentially leading to remote code execution if the web server or application treats the file as executable.