The vulnerability is an unrestricted upload flaw that permits uploading files of any type, including executable scripts such as PHP web shells. By injecting a malicious file, an attacker can achieve remote code execution on the web server, compromising confidentiality, integrity, and availability of the affected website. This weakness is identified as CWE-434 – Unrestricted Upload of File with Dangerous Type.

The flaw exists in the WordPress plugin "JP Students Result Management System Premium" from vendor joy2012bd, specifically version 1.1.7 and all subsequent releases until a fix is applied. Any WordPress site running this plugin is potentially exposed.

The CVSS score of 9 signifies critical severity, while the EPSS score of less than 1% indicates low yet non‑zero probability of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, the known attack vector is the plugin’s upload interface, which an attacker can use to upload a web shell and execute arbitrary code. The combination of high impact and potential for remote execution makes this flaw a high‑priority risk for affected installations.