The vulnerability is an unrestricted file upload flaw that permits uploading of files with dangerous types. This flaw enables an attacker to upload a web shell to the web server and subsequently execute arbitrary code, effectively providing remote code execution.

The flaw exists in StellarWP Kadence WooCommerce Email Designer WordPress plugin version 1.5.14 and all earlier releases. Any WordPress site that has this plugin installed and has not been updated beyond 1.5.14 is vulnerable.

The CVSS score of 9.1 classifies the flaw as high severity, and the EPSS score of less than 1% indicates that while exploitation is not frequently observed, the potential impact justifies urgent attention. The flaw is not catalogued in CISA’s KEV. Based on the description, it is inferred that the attacker would need to reach the plugin’s upload interface, which is typically accessible to authenticated site administrators or users with sufficient privileges. Once the upload functionality is accessed, the attacker could place a malicious file, such as a web shell, onto the server, thereby gaining full control over the affected site and its data.