The studied flaw allows an attacker to upload any file, including executable shell scripts, due to the lack of type validation in the STAGGS plugin. Once a malicious file such as a web shell is placed on the server, the attacker can run arbitrary commands, thereby compromising confidentiality, integrity, and availability of the entire web application. This weakness is identified as CWE‑434.

The vulnerability impacts the WordPress STAGGS plugin, versions up through and including 2.11.0. All sites using any of those releases are potentially exposed.

The CVSS score of 10 marks the issue as critical, while the EPSS score of less than 1% indicates a low, yet non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers would likely exploit the upload interface provided by the plugin, a path that requires at least some level of site access; the description does not specify whether public or authenticated access is sufficient, so this remains an inference. Successful exploitation would grant full server control via an uploaded web shell.