The Appointify plugin for WordPress contains an unrestricted file upload flaw that allows an attacker to upload files with dangerous types, such as PHP scripts. By uploading a malicious web shell, an attacker can gain code execution on the web server, which can lead to full system compromise and data exfiltration. This weakness is identified as CWE-434 and directly undermines the confidentiality, integrity, and availability of the affected site.

The vulnerability affects every installation of the Appointify plugin version 1.0.8 and earlier. Sites running WordPress with this plugin version are at risk, regardless of the site's domain or size. All users of Appointify <= 1.0.8 on any WordPress installation share the same exposure.

The CVSS score for this flaw is 6.6, indicating a moderate severity. The EPSS score is reported as less than 1 percent, showing that exploit activity is currently very rare. The plugin is not listed in CISA’s KEV catalog. Attackers would need remote access to the upload interface of the plugin, which is typically exposed via the WordPress admin panel. If an attacker succeeds, they can execute arbitrary PHP code, creating a full compromise. Given the moderate CVSS and low EPSS, the overall risk is considered moderate but warrants prompt remediation.