The WP Editor plugin contains a flaw that allows an authenticated user with administrative privileges to write arbitrary files to the server. By skipping proper file‑path validation in all versions up to 1.2.9.1, it is possible to overwrite configuration, core WordPress, or plugin files, which in turn can lead to code execution if the web server can write to executable files or if resident scripts are replaced.

All WordPress sites running the WP Editor plugin by Benjamin Rojas with a version of 1.2.9.1 or earlier are affected. The vulnerability is present across all installation paths that expose the plugin’s file‑update functionality to users who have Administrator or higher roles.

The CVSS score is 7.2, indicating a medium to high severity. The EPSS score of 2 % suggests it is not highly prevalent in the wild but still worth monitoring. The vulnerability is not listed in the CISA KEV catalog. Attackers must first compromise an administrator account or otherwise gain the necessary role; no remote exploitation is possible without that prerequisite. If compromised, overwriting critical files can lead to remote code execution, depending on file permissions and the nature of the overwritten file.