The Front End Users plugin for WordPress allows unauthenticated users to upload arbitrary files because the plugin does not validate file types during the registration form file upload. This flaw enables an attacker to place malicious files on the web server, which may then be executed to compromise the site and achieve remote code execution. The vulnerability is a classic missing file type validation flaw reflected in CWE-434.

All WordPress installations using the rustaurius Front End Users plugin version 3.2.32 or earlier are affected. The plugin is listed as Front End Users in the Vendor section and appears in the CPE string as etoilewebdesign:front_end_users. Users should identify any site that has this plugin installed and check the version number.

The CVSS score of 9.8 marks the flaw as Critical, and the EPSS score of 1% indicates it is occasionally exploited in the wild. Because the attack does not require authentication and can be performed through the publicly visible registration form, the likely attack path is a direct HTTP POST to the upload field. The vulnerability is not currently listed in the CISA KEV catalog, but the high severity warrants immediate attention.