The External image replace WordPress plugin is vulnerable because its replace_post function performs no file type validation for uploads. This flaw allows an authenticated user with contributor or higher privileges to upload any file type to the web root. When such a file can be executed, it opens the possibility of remote code execution and full site compromise.

WordPress sites running the muromuro External image replace plugin, versions 1.0.8 and earlier. The vulnerability is present in all releases up to and including 1.0.8.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is authenticated, meaning any contributor or higher role can exploit the flaw. An attacker could upload malicious files and, if the server allows execution, execute arbitrary code.