The ProjectList plugin for WordPress contains a missing file type validation flaw that allows authenticated users with Editor-level access or higher to upload any file to the site’s server. An attacker who can place a malicious script in the uploaded file could achieve remote code execution on the host, compromising confidentiality, integrity and availability of the web application and underlying operating system.

This vulnerability afflicts the ProjectList plugin by the vendor ov3rkll, specifically all releases up to and including version 0.3.0. Site owners running any of these affected plugin releases are at risk.

The vulnerability scores a CVSS 7.2, indicating a high level of severity. The EPSS score is below 1 %, suggesting that currently the likelihood of exploitation is low, and the issue is not listed in CISA’s KEV catalog. Because it requires authenticated access with Editor or higher privileges, the attack vector is internal or through compromised credentials. Once an attacker uploads a malicious payload, the lack of file type filtering can allow code execution if the uploaded file is placed in a writable directory that is served by the web server.