The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the PostGalleryUploader class in all versions up to and including 1.12.5. The flaw allows authenticated users with subscriber level and above permissions to upload files that are not properly vetted. Because the uploaded file can be placed under a web‑accessible directory and may contain executable code, attackers could potentially gain remote code execution capabilities on the affected site. The weakness aligns with CWE-434: Unrestricted Upload of File with Dangerous Type.

This vulnerability affects the rtowebsites PostGallery plugin for WordPress. All installed copies of the plugin with a version number of 1.12.5 or earlier are impacted. Sites using the 1.12.5 variant or older are therefore at risk.

The CVSS score of 8.8 classifies this flaw as High severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at present, though the vulnerability remains exploitable. The flaw is not listed in CISA KEV. Attackers must be authenticated and hold at least subscriber‑level privileges to use the upload interface. The likely attack path is to submit a malicious file through the plugin’s upload mechanism; because the file type is not validated, the server may store the file in a location that can be executed as a script, thereby enabling remote code execution.