The Advanced Settings plugin implements an upload mechanism that accepts files without validating the MIME type, permitting an attacker to place a malicious script such as a web shell on the server. Once uploaded, the attacker can execute arbitrary PHP code, effectively gaining remote code execution and full control over the affected WordPress instance.

The flaw exists in the Helmut Wandl Advanced Settings WordPress plugin, affecting all releases from the initial version up through 3.1.1. The vulnerability is present in all installations of these versions unless the plugin is otherwise disabled or the upload feature is removed.

The CVSS score of 9.1 signals a severe risk. The EPSS score indicates that, although the probability of exploitation is currently low, the presence of a web shell upload remains a critical concern for operators unaware of the issue. The vulnerability is not yet listed in CISA KEV. Attackers can exploit this flaw by using the plugin’s upload interface, which most likely requires an authenticated administrator or privileged user. Because the plugin allows storing PHP files, once the file is uploaded, an attacker may directly access the script through the web server to execute arbitrary code.