The vulnerability in Themefic BEAF allows an attacker to upload any file type without restriction. The ability to upload a web shell grants the attacker full remote code execution on the affected web server, exposing confidential data, enabling server compromise, or facilitating further attacks. The weakness aligns with CWE‑434, identifying an unrestricted input leading to code execution.

The issue applies to the Themefic BEAF "beaf‑before‑and‑after‑gallery" WordPress plugin versions up to and including 4.6.10. Systems running WordPress with this plugin version are susceptible; the plugin is identified by a CPE marking it for WordPress.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score of less than 1 % indicates a low probability of exploitation in the general threat landscape, and it is not currently listed in the CISA KEV catalog. An attacker could exploit the flaw by accessing the plugin’s upload interface, submitting a chosen file—such as a malicious PHP web shell—thereby executing code on the server. No specialized prerequisites are noted beyond the ability to access the plugin’s upload function.