The vulnerability is caused by missing file type validation in the upload endpoint of the Alex Reservations plugin. An authenticated attacker with Administrator or higher privilege can call /wp-json/srr/v1/app/upload/file and upload any file. Because the plugin does not check the MIME type or extension, the attacker can place executable code, such as a PHP script, on the server. If the upload directory allows execution, the attacker can run that code, leading to remote compromise of the WordPress site and the underlying server.

All WordPress installations running the Alex Reservations: Smart Restaurant Booking plugin version 2.2.3 or earlier are affected. The issue exists in the plugin’s upload controller and applies to any site that has the plugin installed and active.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is presently unlikely and it is not listed in the CISA KEV catalog. However, the need for Administrator‑level credentials is a significant barrier that can still be breached via credential compromise or insider threat. Once authenticated, an attacker can upload malicious content and potentially execute code, which would compromise confidentiality, integrity, and availability of the site and its data.