WordPress plugin 'Forms' by Made I.T. contains an unrestricted file upload flaw, identified as CWE-434, that permits an attacker to upload any file type, including executable web shells. By successfully uploading such a file to the server, an adversary can execute arbitrary code on the web server with the permissions of the web application, compromising confidentiality, integrity, and availability of the host and any data processed by the site.

All released versions of the WordPress Forms plugin by Made I.T. up to and including 2.9.0 are affected. Any website that has this plugin active and the upload interface accessible is vulnerable. Versions newer than 2.9.0 are presumed patched, though a specific fix version is not listed in the data.

The CVSS score of 9.9 classifies the issue as critical. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the Forms plugin’s upload endpoint; it is inferred that the upload page is reachable by users without privileged access, though the exact authentication requirements are unspecified. If an attacker can reach this endpoint, they can upload a malicious file and gain full code‑execution privileges on the web server.