The Pin WP WordPress theme exposes an unrestricted file upload endpoint that does not enforce type validation. An attacker can upload a PHP web shell, which, when executed, allows arbitrary code to run on the web server. This provides an attacker with full control over the compromised host and enables data exfiltration, defacement, or lateral movement.

All releases of the Pin WP theme by An-Themes prior to version 7.2 are vulnerable.

The CVSS score of 9.9 classifies the flaw as Critical. The EPSS score of less than 1% indicates a low probability of exploitation at present, yet the impact remains severe. The flaw is not listed in CISA KEV, implying no confirmed active exploits. The likely attack vector is a remote HTTP POST request to the theme's file upload endpoint, allowing an attacker to upload a PHP web shell even on publicly accessible sites. With such a shell in place, an attacker would gain immediate remote code execution capabilities, compromising server integrity and confidentiality.