An attacker can exploit the Theme File Duplicator plugin for WordPress, up to version 1.3, to upload any file type without restriction. This flaw allows a malicious actor to place executable code on the web server, potentially leading to full compromise of the site’s confidentiality, integrity, and availability.

The vulnerability affects the rockgod100 Theme File Duplicator plugin for WordPress. Any installation of the plugin with a version of 1.3 or earlier is potentially impacted. No specific patch release details are provided in the available data.

The CVSS score is 9.9, indicating critical severity. The EPSS score is below 1 percent, suggesting low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves using the plugin’s file upload functionality, which an attacker can trigger either as an authenticated user or by abusing the upload endpoint. Successful exploitation could result in remote code execution if a PHP file is uploaded and executed.