The vulnerability allows an attacker to upload arbitrary file types through the booking plugin’s upload endpoint because the plugin does not validate MIME types or inspect file contents. A malicious user can thus place a script such as a PHP file on the server. If the file is executed via a browser request or by exploiting server execution policies, the attacker can run arbitrary code on the WordPress installation, effectively compromising the site.

The affected product is the vcita Online Booking & Scheduling Calendar for WordPress plugin, with all releases up to and including version 4.5.3. WordPress sites that have not upgraded beyond 4.5.3 and that allow unauthenticated or low-level authenticated access to the upload functionality are at risk.

The flaw carries a CVSS score of 9.1, denoting critical severity, while the EPSS score is below 1%, indicating a low probability of immediate exploitation. Nonetheless, the readily exploitable server-side upload flaw and the plugin’s common usage mean that a determined adversary could target the system. The vulnerability is not in the CISA KEV catalog, but the likely attack vector is a web-based file upload performed by a user with permission to add bookings, and the absence of MIME validation makes exploitation straightforward.