Based on the description of an Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b FW Gallery, it is likely that authentication is not required to upload files of dangerous types. An attacker can upload a malicious script or binary to the server’s upload directory, potentially executing code in the context of the web application. This flaw could allow attackers to compromise sensitive data, hijack user sessions, or install persistent backdoors, thereby enabling full control over the affected WordPress site.

Fastw3b LLC’s FW Gallery plugin for WordPress, versions from the initial release through 8.0.0, is affected. Site owners running any < 8.0.1 installation of the plugin are vulnerable.

The vulnerability has a CVSS score of 10, indicating critical severity. The current EPSS score is less than 1%, suggesting that while exploitation is theoretically easy, incidents are rare at present. It is not listed in the CISA KEV catalog. Attackers could remotely exploit the upload functionality, likely via the web interface, though this is inferred from the term ‘Unrestricted Upload’. The statement that the risk surface is wide for publicly exposed sites is also inferred, as the CVE does not explicitly mention site exposure.