The Squeeze plugin contains an unrestricted file upload vulnerability that allows an attacker to upload files with dangerous types, potentially executing malicious code on the server. This weakness, identified as CWE‑434, can compromise the confidentiality, integrity, and availability of the affected WordPress site. If a file with executable code is uploaded, the attacker can run arbitrary programs, extract data, or take control of the system.

WordPress installations running the Squeeze plugin by Bogdan Bendziukov, version 1.6 or earlier. The issue affects all sites that have not upgraded beyond version 1.6 and still rely on the default upload functionality of the plugin.

The CVSS score of 9.1 highlights a high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires access to the plugin’s upload page through the WordPress admin interface. The attack vector is inferred to be a remote authenticated user who can upload files; once the malicious file is stored, it may be executed or accessed to gain further privileges.