The vulnerability is an unrestricted file upload flaw that allows an attacker to upload files of any type to the server. If a malicious executable or web shell is uploaded, the attacker can run arbitrary code with the privileges of the web application, potentially compromising the entire site and any connected services. The weakness is identified as CWE-434, which describes improper validation and handling of user-supplied file input.

The flaw affects the InspiryThemes Real Homes CRM WordPress plugin, all releases from the earliest iterations through version 1.0.0. Any WordPress installation that has this plugin installed and not upgraded beyond 1.0.0 is susceptible.

Based on the description, it is inferred that the likely attack vector is an unauthenticated or authenticated user submitting a file through the plugin’s upload form, bypassing any server‑side checks. The CVSS score of 9.9 classifies this as a critical vulnerability. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis, and it is not yet included in CISA’s KEV catalog. Nevertheless, successful exploitation can grant the attacker full control over the web root, allowing data exfiltration, defacement, or the deployment of additional malware.