The plugin allows an attacker to upload any file type, including executable web shells, without proper validation. This unrestricted upload capability can be leveraged to deploy malicious code on the web server, effectively granting the attacker remote code execution privileges. The flaw is categorized under CWE-434, indicating that the vulnerability arises from insufficient filtering of user-supplied file types.

Any WordPress site using the ngocuct0912 WP Load Gallery plugin version 2.1.6 or earlier is affected. This includes all installations where the plugin is active, regardless of the WordPress core version, as the vulnerability resides solely in the plugin’s upload handling.

The score of 9.1 on the CVSS scale marks this as critical, and an EPSS of 45% suggests a high probability of exploitation. Although not listed in the CISA KEV catalog, the ease of uploading a web shell via a publicly accessible interface indicates that the likely attack vector is the plugin’s file upload form, which may be reachable by any authenticated user or possibly unauthenticated users depending on site configuration. An attacker could exploit this flaw to place a shell and then execute arbitrary commands on the server, creating full control over the compromised site.