The Enable SVG, WebP, and ICO Upload plugin allows an attacker who has author‑level (or higher) permissions to upload files with double extensions that conceal malicious payloads. The plugin's file type validation accepts ICO files after checking only the magic bytes, which means a file such as "upload.php.jpg" or "image.png.svg" can be uploads as an ICO. Once stored on the server, an attacker can place executable scripts or web shells that may be accessed and run, resulting in full remote code execution on the WordPress site. This weakness is a classic example of unvalidated file upload (CWE‑434).

The issue exists in the WordPress plugin Enable SVG, WebP, and ICO Upload, produced by the vendor ideastocode. All versions of the plugin up to and including 1.1.3 are affected; version 1.1.4 and later contain the fix.

The vulnerability scored a CVSS of 8.8, indicating high severity. The EPSS score is below 1%, showing a very low likelihood of exploitation at the time of analysis. The plugin is not listed in the CISA KEV catalog. Although the risk is high if an attacker gains author‑level access or higher, the probability of exploitation remains low at present. Successful exploitation requires authenticated access and the ability to upload files, making the threat vector likely an insider or attacker who has compromised credentials.