The WPAMS apartment‑management plugin for WordPress contains an unrestricted file upload feature that accepts any file type. An attacker can exploit this flaw to upload a malicious web shell, which then grants the ability to execute arbitrary code on the web server. This weakness is classified as Unrestricted Upload of File with Dangerous Type (CWE‑434).

The vulnerability affects the WPAMS plugin developed by mojoomla. All installations of the plugin from the unknown initial release through version 44.0 (release date 17‑08‑2023) are impacted; no other products or vendors are specifically mentioned.

The CVSS score of 9.9 marks the flaw as critical, though the EPSS score of < 1% indicates a very low probability that it will be exploited in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be carried out remotely via any accessible upload interface, so the likely vector is web‑based. An attacker who can reach the upload form, whether through legitimate or compromised credentials, can upload a web shell and potentially gain full control over the host.