The vulnerability enables an attacker to upload files of any type, including web shells, to the WordPress server. Once uploaded, the attacker can execute code as the web server, enabling full control over the compromised site and potential lateral movement. This represents a classic arbitrarily dangerous type upload flaw (CWE‑434) with severe confidentiality, integrity and availability implications.

The flaw is present in the WordPress Hospital Management System plugin from mojoomla, affecting version 47.0 and earlier. Sites hosting this plugin are at risk when the upload mechanism remains accessible.

The CVSS score of 9.9 reflects a critical severity and indicates that a network attacker can exploit the flaw remotely. The EPSS score of less than 1% suggests that, as of the latest data, exploitation is not highly prevalent in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based file upload request sent to the plugin’s upload endpoint; when accessed by an attacker, it permits uploading a malicious file that then executes on the server.