Scriptonite User Files exposes an unrestricted file upload flaw that allows an attacker to place a web shell on the target web server. By uploading a file of a dangerous type, the attacker can embed executable PHP or other code, effectively gaining remote code execution capability. The weakness is categorized as CWE-434, indicating that the application does not verify or restrict the MIME type or extension of uploaded files, thereby compromising confidentiality, integrity, and availability for the entire site.

Any WordPress installation running the Scriptonite User Files plugin version 2.4.2 or older is affected. The vulnerability applies to all releases from the earliest available version through 2.4.2.

The severity is highest, with a CVSS score of 10. The EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw remains exploitable through the plugin’s upload interface, which is accessible to authenticated or unauthenticated users depending on configuration. An attacker who can reach the upload form can inject a web shell that once executed, allows full control over the server.