The vulnerability allows an attacker to upload a file with a dangerous type, specifically a web shell, to the server via the Themefic Instantio plugin. This could give the attacker complete code execution privileges on the affected WordPress site, leading to full compromise of the web server and any data stored there. The weakness is a classic instance of unrestricted file upload (CWE‑434) that enables direct insertion of executable code into the web environment.

The flaw exists in Themefic Instantio for WordPress, affecting all versions up to and including 3.3.16. The plugin is installed on WordPress sites, so any site running a vulnerable version of Instantio is at risk.

With a CVSS score of 6.6 and an EPSS score below 1%, the severity is moderate but the likelihood of exploitation remains low and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local to the application context: an authenticated WordPress administrator could exploit the flaw through the plugin’s upload interface, but an unauthenticated attacker would first need to compromise administrative credentials or access.