The vulnerability allows a malicious actor to upload arbitrary files by bypassing the plugin’s file type validation, which could lead to remote code execution if executable content is placed on the server.

WordPress plugin Case Addons from Case‑Themes, with any installation using a version earlier than 1.3.0.

The CVSS score of 9.9 signals a critical severity; the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation; the vulnerability is not listed in CISA KEV; based on the description, the likely attack vector is a web‑based file upload interface provided by the plugin that accepts any file type without validation, which could allow an attacker to place executable code on the server.