An unrestricted upload vulnerability in the WordPress 4ECPS Web Forms plugin allows attackers to upload files of any type. By uploading a web shell or other executable code, an adversary can gain remote code execution on the web server, compromising confidentiality, integrity, and availability of the site and any back‑end services. The weakness is classified as CWE‑434: Unrestricted Upload of File with Dangerous Type.

The vulnerability affects the jumpdemand 4ECPS Web Forms plugin for WordPress. All releases up to and including version 0.2.18 are susceptible. Site owners who have not upgraded beyond this version are at risk.

The CVSS score of 10.0 indicates a critical threat. Although the EPSS score is below 1%, meaning the probability of exploitation is low, the lack of a KEV listing does not reduce the urgency of remediation. Attackers can exploit the flaw via the plugin’s file‑upload interface; the attack vector is inferred to be from any authenticated or unauthenticated user who can access that interface, depending on the site’s configuration.