Theme Egg’s ThemeEgg ToolKit plugin up to version 1.2.9 suffers from an unrestricted file upload flaw that permits upload of arbitrary files with dangerous content. The vulnerability can be leveraged to introduce a web shell into the WordPress installation, enabling an attacker to execute code on the server, compromise confidentiality, integrity, and availability of the website and potentially its underlying infrastructure. The weakness corresponds to CWE‑434, Unrestricted Upload of File with Dangerous Type.

WordPress sites running the ThemeEgg ToolKit plugin whose version is earlier than or equal to 1.2.9 are affected. The vulnerability applies to all deployments of the plugin where the upload functionality is enabled, regardless of the hosting environment.

The CVSS score of 9.1 and an EPSS score of 25% indicate a very high severity and a high probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw—an unauthenticated or minimally authenticated upload mechanism—makes exploitation straightforward for adversaries. An attacker can craft a malicious upload request to the plugin’s endpoint, place a web‑shell script, and then access it via the web server, achieving full remote code execution.