The vulnerability allows an attacker to upload files of dangerous types without restriction. When such files are uploaded, they can be executed on the server, leading to complete compromise of the site’s confidentiality, integrity, and availability. The weakness is a failure to validate or control upload content, classified as CWE-434.

This flaw affects the dkszone Celestial Aura WordPress plugin for all releases up to and including version 2.2.

With a CVSS score of 9.9 the vulnerability is considered critical. Although the current EPSS indicates a very low probability of exploitation, the lack of any restriction on file type makes the attack surface sizable. The flaw is not listed in the CISA KEV catalog, yet an attacker can exploit it remotely by sending a crafted request containing a malicious file through the plugin’s upload interface. The potential impact of a successful exploit is full site takeover.