The vulnerability is an unrestricted upload of files with dangerous types that allows an attacker to place a web shell on the WordPress site’s server. The flaw is classified as CWE-434, where the system fails to restrict undersired content types. If an attacker succeeds, they can execute arbitrary code in the context of the web server, compromising confidentiality, integrity, and availability of the affected site.

The issue affects the LABCAT Processing Projects WordPress plugin versions from the earliest available release through version 1.0.2. Users running those versions are exposed to the risk.

The severity is high, with a CVSS score of 9.1. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. While the CVE documentation does not detail the exact attack vector, it is inferred that an attacker could exploit the plugin’s file‑upload interface—most likely via the administrative dashboard—to upload a malicious file. The lack of type validation is the root of the risk.