The Echo RSS Feed Post Generator plugin for WordPress allows file uploads without validating the file type in the echo_generate_featured_image() function, which is present in all versions up to and including 5.4.8.1. This missing validation enables an attacker who does not have to authenticate to the WordPress site to upload any file they choose to the server. Because the uploaded content can be executed by the web server, an attacker could place a malicious script and then run it, giving them the ability to execute arbitrary code on the host. The flaw is a classic example of CWE‑434, unvalidated file upload.

The affected product is CodeRevolution’s Echo RSS Feed Post Generator plugin for WordPress. All releases through 5.4.8.1 are vulnerable; any installation of the plugin with a version number of 5.4.8.1 or older is at risk.

The vulnerability has a CVSS score of 9.8, indicating critical severity. The EPSS score of 2% shows that attacks are unlikely but the probability is non‑zero, and the issue is not yet listed in CISA's KEV catalog. Attackers do not need network access to the WordPress admin interface; they only need to be able to reach the upload endpoint, typically a publicly accessible URL, making the attack straightforward once the plugin is present.