Unrestricted upload of files with dangerous types is possible through the Agile Logix Store Locator WordPress plugin. The flaw allows an attacker to place a web shell on the server, giving the attacker remote code execution and compromising confidentiality, integrity, and availability of the site. The weakness is classified as CWE‑434, which concerns missing validation of file types during upload.

The vulnerability affects the Agile Logix Store Locator WordPress plugin for WordPress. Versions from the earliest release through and including 1.5.2 are impacted. All installations using these versions are susceptible to the described attack vector.

The CVSS score of 6.6 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by accessing the plugin’s upload interface and submitting a malicious file, resulting in code execution if the file is stored in a web-accessible directory. Because the stored file may be executable, the damage potential is high for the affected system.