This vulnerability permits an attacker to upload arbitrary files because the Simplified plugin fails to validate or filter the file type. An attacker can use this to place malicious code on the web server, which may then be executed, enabling complete compromise of the site. The weakness is a classic Unrestricted File Upload flaw.

The affected product is the kodeshpa Simplified WordPress plugin for all releases up to and including version 1.0.6. Users running any of these versions are at risk.

The CVSS score of 10 indicates the highest severity. An EPSS score of 8% suggests a moderate probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, but if exploited the attack would likely be performed remotely via the plugin's upload interface, with no privileged access required. Because the flaw allows arbitrary content to be written to the server, an attacker could immediately gain code execution privileges.