The vulnerability allows an attacker to upload any file type, including executable web shells, to a WordPress site running the Contentstudio plugin. Because there is no file type filtering, an adversary can place a malicious script on the server, achieving remote code execution and full control of the affected site. This flaw directly compromises the confidentiality, integrity, and availability of the site.

The flaw exists on all installations of the Contentstudio WordPress plugin up to and including version 1.3.7. Systems running WordPress with this plugin and any of those versions are susceptible.

With a CVSS score of 9.1 the vulnerability is classified as critical. The EPSS score of <1 % indicates a low probability of exploitation at present, and the vulnerability is not yet in the CISA KEV catalog. Nevertheless, the attack vector is inferred to be through the plugin’s file‑upload interface, which is typically accessible to any authenticated or even unauthenticated user depending on the site configuration. Once an attacker uploads a web shell, they can execute arbitrary code with the privileges of the web server.