The Woffice Core plugin for WordPress contains a flaw that omits file type validation in its "saveFeaturedImage" routine for all releases up to and including version 5.4.21. The result is that authenticated users with at least Subscriber privileges can upload any file to the site’s server. Because no MIME check or file extension restriction is performed, an attacker could upload a malicious script and later trigger its execution, effectively compromising the host. This vulnerability maps to CWE‑434, denoting Improper Restriction of Definable Media Type.

The affected product is the Woffice Core plugin provided by WofficeIO, which is integrated into the Woffice Theme for WordPress. All releases of Woffice Core through 5.4.21 are vulnerable. Users running WordPress sites that rely on this plugin and theme are exposed, regardless of the site’s broader security posture.

The common vulnerability scoring system rates this issue at 8.8, indicating severe impact. The estimated probability of exploitation, as reflected by an EPSS score of 1 %, is low but non‑negligible, particularly within environments where an attacker already obtains Subscriber‑level access. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploits have been confirmed yet, but the potential for remote code execution warrants immediate control.