The Aeropage Sync for Airtable plugin for WordPress contains an arbitrary file upload flaw due to missing file type validation in the aeropage_media_downloader function. Authenticated users with Subscriber-level permissions or higher can upload any file type to the server. If the uploaded file is a PHP script or other executable content, it could enable an attacker to run arbitrary code on the server, compromising confidentiality, integrity, and availability.

The vulnerability affects the Aeropage Sync for Airtable WordPress plugin from Aeropage. All releases up to including version 3.2.0 are impacted. Any WordPress site that has this plugin installed in those versions is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of 3% shows a modest probability of exploitation in the wild, and the flaw is not currently listed in CISA's KEV catalog, suggesting no recorded large‑scale attacks yet. Exploitation requires a user authenticated as Subscriber or higher on the target WordPress installation. Once uploaded, an attacker may place a malicious file in a location from which it can be executed, possibly leading to remote code execution. The absence of validation makes the attack path straightforward when the attacker has legitimate credentials.