The ContentStudio plugin for WordPress contains a missing file type validation in the cstu_update_post() function in all versions up to and including 1.3.7. This flaw allows authenticated users with Author-level access or higher to upload any file to the site’s server. If an attacker can upload a file that is executed by the web server, the compromise can become full remote code execution, giving the attacker control over the host. The weakness is a classic missing file type validation, classified as CWE‑434.

WordPress sites that use the ContentStudio plugin version 1.3.7 or earlier. Any such installation is vulnerable to arbitrary file uploads when an author or higher level user has access to the plugin’s update functionality.

With a CVSS score of 8.8, the vulnerability is assessed as high severity. The EPSS score of < 1% indicates a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with author or higher privileges, which could be achieved through credential compromise or social engineering. If an attacker succeeds in uploading a malicious file, the potential for remote code execution depends on the web server’s configuration and filesystem permissions. The vulnerability is thought to be a duplicate of CVE‑2025‑67910.