WordPress Tourfic plugin contains an unrestricted file upload that accepts dangerous file types. The flaw allows an attacker to upload a web shell, providing the ability to execute arbitrary code on the hosting server. This vulnerability is a classic CWE‑434, and any successful exploitation compromises confidentiality, integrity, and availability of the affected website.

Vendor Themefic distributes the Tourfic plugin for WordPress. All versions up to and including 2.15.3 are affected. Hosts running these versions are at risk unless the plugin is updated to a newer release.

The CVSS score of 9.1 marks this as a high‑severity vulnerability. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is likely the flaw is exploitable remotely via the public upload interface; an attacker requires an authenticated or unauthenticated web access with file upload permissions, which is commonly available on many WordPress sites. Successful exploitation would lead to immediate remote code execution.