The vulnerability is an unrestricted file upload that permits an attacker to place a web shell on the server. Once the shell is uploaded, an attacker can execute arbitrary code, compromising confidentiality, integrity, and availability of the affected WordPress site. This reflects weakness CWE‑434, where the system accepts files of dangerous types without properly validating them.

The affected product is RexTheme WP VR under the WordPress plugin "WP VR" for all releases that are from the earliest available version through version 8.5.26. No specific sub‑version details beyond the upper bound are listed, so any installation running 8.5.26 or earlier is vulnerable.

The CVSS score of 9.9 marks this flaw as Critical, and the EPSS score of less than 1% indicates that, while exploitation is considered unlikely at present, the potential impact is severe. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would most likely exploit this by sending a crafted request to the plugin’s file‑upload interface, bypassing any MIME type checks. No complex prerequisites are disclosed; basic authenticated or unauthenticated access to the upload endpoint would suffice according to the description.