The SoJ SoundSlides WordPress plugin is vulnerable due to missing file type validation in the soj_soundslides_options_subpanel() function in all releases up to 1.2.2. The flaw permits authenticated attackers who hold at least Contributor permissions to upload arbitrary files to the site’s server, which may lead to remote code execution if the attacker can place executable code or scripts. The security weakness is identified as CWE-434 "Missing Restriction on File Uploads."

WordPress installations that use the SoJ SoundSlides plugin in version 1.2.2 or earlier are affected. The plugin allows file uploads only when a user has Contributor-level access or higher. No other versions or editions of the plugin are known to be impacted.

The vulnerability carries a CVSS v3.1 score of 8.8, indicating a high severity and substantial impact. The EPSS score of 2% suggests a modest but non‑negligible probability of exploitation. The flaw is not listed in CISA’s KEV catalog, but the combination of authentication requirement and lack of validation makes it attractive to attackers with legitimate contributor access. Exploitation would require a logged‑in Contributor or higher user to execute the upload functionality, after which the attacker could place malicious code in web‑accessible locations.