This vulnerability originates from an omitted or incorrect nonce check in the uploadImage() routine of the Bread & Butter WordPress plugin. The missing CSRF protection lets an unauthenticated attacker submit a crafted request that uploads any file to the server. If the attacker can trick a site administrator into visiting the forged URL, the uploaded file may be executed as code, enabling full control over the affected system.

Bread & Butter AI‑Powered Lead Intelligence plugin for WordPress, all versions up to and including 7.11.1374.

The CVSS score of 4.3 indicates a moderate risk level, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector relies on CSRF: an attacker must lure an administrator to click a malicious link, after which arbitrary file upload and potential remote code execution become possible. Privilege escalation is not required, but the outcome can be fully deterministic if the admin authorizes the request.