The WP Enable WebP plugin for WordPress suffers from improper file type validation in its upload functionality. An authenticated user with Author or higher privileges can upload arbitrary files to the server. If the attacker uploads a file capable of being executed, such as a PHP script, remote code execution may be achieved. The weakness is classified as CWE‑434. The vulnerability is present in all plugin versions up to and including 1.0.

The affected product is WP Enable WebP from eastsidecode. All releases dating from the first version through 1.0 are vulnerable; no fix is provided in version 1.0 and later releases have not been listed yet.

The CVSS score of 8.8 indicates high severity, while the EPSS score of under 1% suggests a low yet non‑zero exploitation probability in the general population. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Author or stronger role, an opportunity that many WordPress sites grant to content authors. An attacker could exploit the upload endpoint to place malicious files on the server and potentially execute them, thereby compromising confidentiality, integrity, and availability of the site.