The vulnerability is an unrestricted upload of files with dangerous types in the WordPress plugin Ajar in5 Embed. It allows an attacker to upload files such as web shells onto the web server, effectively giving the attacker the ability to execute arbitrary code on the host. This flaw is classified as CWE‑434 and can directly compromise the confidentiality, integrity, and availability of the affected site if exploited.

The WordPress plugin Ajar in5 Embed from Ajar Productions is affected in all versions released through 3.1.5, including earlier releases. Sites running any of these versions are potentially vulnerable.

The CVSS score of 10 indicates a critical severity and the potential for remote code execution. The EPSS score of less than 1% suggests a very low probability of active exploitation at the time of this analysis, and the vulnerability is not yet listed in the CISA KEV catalog. An attacker would typically use the plugin’s upload interface to submit a malicious file, a step that likely requires web access to the administrative interface; no additional privileges are mentioned in the description, so the attack vector is inferred to be remote.