The Pie Forms for WP plugin contains an insufficient file type validation flaw that allows an unauthenticated attacker to upload files with dangerous extensions such as PHP through the format_classic function. The validate_classic method only checks extensions and sets an error message but continues the upload process, enabling the attacker to place a malicious file on the server. If such a file is executed, the attacker can run arbitrary code on the hosting web server, effectively compromising the entire WordPress site.

The vulnerability targets the Pie Forms — Drag & Drop Form Builder developed by genetechproducts for WordPress. Any WordPress site running the plugin in version 1.6 or earlier is susceptible, particularly the file upload field provided by the plugin. The attack requires no authentication, making all sites with the vulnerable plugin a potential target.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, suggesting exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is unauthenticated form submission, and the upload directory is a somewhat predictable hash while the file name is hashed, reducing but not eliminating the risk of remote code execution.