The Infility Global plugin for WordPress contains missing file type validation and capability checks in its file upload functions. Authenticated users with subscriber or higher privileges can upload arbitrary files by forging MIME types, and no restriction is applied on the file contents. This flaw permits attackers to place malicious payloads on the server, potentially enabling remote code execution and jeopardizing the confidentiality, integrity, and availability of the site.

Infility Global plugin for WordPress, versions 2.14.42 and earlier.

The vulnerability carries a CVSS score of 8.8, indicating high severity. With an EPSS score of less than 1% and not listed in the CISA KEV catalog, the likelihood of exploitation is low, but not negligible. Attackers would need authenticated access at the subscriber level or higher, implying the attack vector is an authenticated web application interaction. If exploited, an attacker could upload executable files that might be executed by the server, yielding full remote code execution.