The vulnerability is a Cross‑Site Request Forgery that permits an attacker to upload an arbitrary file to the web server. If a malicious file such as a web shell is uploaded, the attacker can gain remote code execution. The CVSS score of 9.6 reflects the high severity of the flaw, and the weakness is identified as CWE‑352.

The affected product is the WP shop plugin from Agence web Eoxia – Montpellier. All versions from the earliest release through 2.6.1 are vulnerable, including the latest 2.6.1 release.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low prevalence of known exploitation at this time. Nevertheless, the high CVSS score indicates a critical risk. The likely attack scenario involves a malicious site sending a crafted request that exploits the missing CSRF protection when an authenticated user (ideally a privileged user or administrator) visits the site, thereby uploading a malicious payload that can be executed by the server.