The Smallerik File Browser plugin for WordPress includes an unrestricted file upload feature that accepts dangerous file types. Attackers can upload a malicious script such as a web shell, which can be executed on the web server, giving the attacker complete control over the server's filesystem, processes, and data. This vulnerability falls under CWE‑434, Insecure File Upload, and enables both confidentiality and integrity breaches.

All releases of the Smallerik File Browser plugin by Enrico Sandoli with a version number less than or equal to 1.1. The vulnerability exists for all WordPress installations that have the plugin enabled in that version range.

The CVSS score of 9.9 reflects the severe impact of this flaw. The EPSS score of less than 1% indicates that, at the time of analysis, the vulnerability was not frequently exploited, and it is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s upload interface, which may require administrative privileges; if users with sufficient permissions can upload files, the attacker can deliver a web shell directly to the server. Once uploaded, the script can be executed and provide remote code execution, making it a critical threat for any affected site.