The vulnerability is an unrestricted upload of files with arbitrary types. An attacker can place malicious code such as a web shell onto the server, enabling the execution of arbitrary commands. This flaw falls under CWE‑434 and can lead to complete compromise of the affected WordPress site, including its data, configuration, and underlying operating system.

The epiphyt Form Block plugin, versions up to and including 1.5.5, is affected. No narrower version qualifiers are available in the current data.

The CVSS score of 9 signals a high severity risk, while the EPSS score of less than 1 % indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, and no publicly known exploits are reported. Attackers can likely exploit the flaw by accessing the plugin’s file upload interface, either through an authenticated account with upload permissions or via a publicly exposed form, and uploading a file that the web server will subsequently execute.