The vulnerability in WebFactory AiBud WP permits an attacker to upload arbitrary files of dangerous types, enabling the placement of a web shell on the server. Once the shell is uploaded, the attacker could execute arbitrary commands, access sensitive data, or disrupt services, compromising the confidentiality, integrity, and availability of the affected WordPress site.

The issue affects WordPress sites that use the AiBud WP plugin in any version up to and including 1.9. The plugin is distributed by WebFactory and is commonly integrated into WordPress installations for AI chatbot functionality.

With a CVSS score of 9.1 the vulnerability is classified as critical. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA KEV. Attackers can exploit the weakness by submitting a malicious file through the plugin’s upload interface, which does not enforce file type validation. This permits remote code execution via the uploaded web shell without additional privileges.