The WP Dropzone plugin for WordPress contains an authentication‑bound arbitrary file upload flaw in all releases up to 1.1.0, where the ajax_upload_handle routine writes uploaded chunks directly to the uploads directory before validating the file type. This flaw can allow an attacker who can log in with subscriber privileges or higher to place any file on the server’s filesystem, and if the file is executable or contains malicious code it may be possible for the attacker to achieve remote code execution on the impacted site.

WordPress sites that have the WP Dropzone plugin installed at version 1.1.0 or earlier are affected. The vulnerability specifically applies to any subscription of the plugin on the site, so site administrators, editors, and other roles with subscriber‑level access could exploit the flaw.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests exploit attempts are currently rare. Because exploitation requires user authentication, an attacker must compromise or compromise the credentials of a legitimate user; without that, the attack is not feasible. The vulnerability is not listed in the CISA KEV catalog, meaning it is not known to have been actively exploited on a wide scale at the time of this analysis. Nonetheless, the potential for remote code execution warrants prompt mitigation.