The vulnerability in the Inline Image Upload for BBPress plugin is caused by the omission of file extension validation during uploads, allowing attackers to upload files of any type. When authenticated as a user with Subscriber level or higher, an attacker can place arbitrary files on the server, which could subsequently be executed, leading to full remote code execution. The plugin also exposes a secondary risk for unauthenticated users when the site configuration permits guest posting, granting the same upload capability without authentication.

WordPress sites that have installed the Inline Image Upload for BBPress plugin version 1.1.19 or earlier are potentially affected. This includes any site using that plugin or older releases, regardless of user role distribution. The issue arises from the plugin’s upload handler itself and is not limited to a specific WordPress core version.

The CVSS score of 8.8 places this flaw in the high severity range, indicating significant impact. The EPSS score of less than 1% suggests that, although serious, the likelihood of exploitation is relatively low. The vulnerability is not listed in the CISA KEV catalog, and no active exploit has been confirmed in the wild. Attackers would need to authenticate as a Subscriber or higher, or rely on guest posting settings, to exploit the flaw. The combination of high severity and low exploitation probability highlights the importance of addressing the issue promptly to prevent potential remote code execution.