The CreedAlly Bulk Featured Image plugin for WordPress allows unrestricted uploads of files with dangerous types, as defined by CWE‑434. An attacker can upload a Web Shell to the server and subsequently execute arbitrary code with the privileges of the web server process. The vulnerability directly compromises confidentiality, integrity and availability of the affected site.

WordPress installations that use the CreedAlly Bulk Featured Image plugin version 1.2.4 or earlier are impacted. The plugin provides a bulk upload interface for featured images, allowing attackers to exploit the vulnerability if the plugin is present.

The CVSS score of 9.1 indicates a high severity. The EPSS score of <1% suggests that widespread exploitation has not yet been documented, but the potential for server compromise remains significant. The likely attack vector is the plugin’s file‑upload endpoint, which is usually protected behind authenticated WordPress admin access, so an attacker would need to compromise or bypass the site’s authentication. Once an attacker can upload a malicious file, arbitrary code execution can be achieved. The vulnerability is not listed in the CISA KEV catalog, but the confluence of a known arbitrary file‑upload flaw and a high CVSS score warrants immediate remediation.