The Starter Templates plugin allows an authenticated user with author-level access to upload files that bypass the plugin’s file type validation by using a double extension, recognizing the file as a valid WXR (WordPress eXtended RSS) file while actually uploading a different payload. This flaw permits arbitrary files to be written to the server’s file system, which can lead to remote code execution if the uploaded file is later executed or exploited. The vulnerability is exemplified by the CWE‑434 (Unrestricted Upload of File with Dangerous Type) weakness that underpins the flaw.

WordPress sites running the Starter Templates plugin, version 4.4.41 or earlier, from the vendor brainstormforce. This includes all installations of the Starter Templates – AI‑Powered Templates for Elementor & Gutenberg plugin where the author or higher role is present.

With a CVSS score of 8.8, the vulnerability is classified as high severity. The EPSS score of less than 1% suggests that it is not widely exploited in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is authentication‑based: an attacker must be able to log in as an author or higher. Once authenticated, the attacker can upload malicious files that may be executed on the server, potentially allowing full control of the site. The combination of high severity and the requirement for legitimate credentials means that organizations should prioritize the update of the plugin as soon as possible to mitigate this risk.