The Aeropage Sync for Airtable plugin for WordPress has a missing file type validation in the aeropage_media_downloader function, a flaw that corresponds to CWE‑434 (Missing File Type Validation). Authenticated users with Subscriber-level access or higher can upload any file type to the server. Based on the description, it is inferred that an attacker can upload executable files, such as PHP scripts, and execute them, leading to remote code execution, which can compromise confidentiality, integrity, and availability of the affected WordPress site.

This flaw affects the Aeropage Sync for Airtable plugin from Aeropage for WordPress installations that run any version up to and including 3.2.0. All WordPress sites that have the plugin installed in those versions are at risk, while versions beyond 3.2.0 are not listed as vulnerable according to vendor data.

The CVSS score of 8.8 indicates a high severity vulnerability, and the EPSS score of 9% shows a moderate probability of exploitation. The flaw is not yet listed in CISA's KEV catalog. Exploitation requires an authenticated Subscriber or higher WordPress account, and the attacker must use the plugin’s media downloader endpoint to upload a malicious file. Once uploaded, the file can be placed in a location from which it can be executed, potentially enabling remote code execution. The absence of file type validation makes the attack path straightforward for anyone with the required permissions.