The Supreme Modules Lite plugin for WordPress suffers from an insufficient file type validation that permits JSON files with double extensions to bypass sanitization. This flaw allows authenticated users with author-level or higher privileges to upload arbitrary files to the web server, potentially leading to remote code execution. The vulnerability is classified as CWE-434, indicating an improper file upload mechanism.

The affected product is Supreme Modules Lite, a plugin used in WordPress sites that employ Divi Theme, Extra Theme, or Divi Builder. All released versions up to and including 2.5.62 are impacted.

The flaw carries a CVSS score of 8.8, reflecting high severity, while the EPSS score of less than 1% indicates a low probability of observed exploitation. It is not listed in CISA’s KEV catalog. The attack requires authenticated access, typically author-level or higher, and involves uploading a malicious file such as a PHP script to achieve remote code execution.