The Droip plugin for WordPress allows authenticated users with Subscriber-level access or higher to upload arbitrary files because the make_google_font_offline() function lacks proper file type validation. Uploaded files may then be executed on the server, enabling remote code execution. This vulnerability is classified as CWE-434, representing an unrestricted upload of a file with a dangerous type. The impact is that an attacker who has legitimate forum or blog ownership credentials can leverage the upload mechanism to place malicious code on the web server, compromising confidentiality, integrity, and availability of the site and potentially the underlying server.

Affects the Droip plugin for WordPress, version 2.5.1 and earlier. The plugin is distributed via the WordPress ecosystem and is available from the official plugin repository and the Droip website. Any WordPress installation that has the Droip plugin at a version that is less than 2.5.2 is vulnerable, regardless of other security settings, because the vulnerability resides purely in the plugin's file upload routine.

The CVSS score of 8.8 marks this vulnerability as high severity. The EPSS score of < 1% indicates that, while the probability of an exploit in the wild is currently low, the existence of the flaw remains a significant risk. The vulnerability is not listed in the CISA KEV catalog, so no mandatory mitigations are in place, but the situation demands careful attention. An attacker must be authenticated as a Subscriber or higher user to exploit the flaw, which limits the attack surface to users with legitimate or compromised credentials on the target WordPress site.