The vulnerability resides in the upload_files() function of the WP User Frontend Pro plugin, which fails to enforce file type validation. An authenticated user with Subscriber access or higher can upload any file to the server when the Private Message module is active and the Business edition of the PRO software is in use. Successful exploitation can lead to arbitrary code execution, allowing an attacker to compromise the entire WordPress installation, exfiltrate data, install backdoors, or disrupt services.

The issue affects the WordPress plugin WP User Frontend Pro provided by WeDevs, versions 4.1.3 and earlier. Administrators who have deployed the Private Message module and are using the Business version of the plugin are at risk. The vulnerability applies only to installations that have at least Subscriber‐level user authentication configured, irrespective of the WordPress core version.

The moderate CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of 1% suggests a low to moderate probability that the flaw will be actively exploited, and the vulnerability is not currently listed in the CISA KEV catalog. Attacks would require legitimate user credentials and the appropriate module configuration, mitigating the risk of widespread, automated exploitation, but still representing a significant threat to any affected site.