Unrestricted upload of dangerous‑typed files in earlier versions of Wiguard allows an attacker to place a web shell directly on the server, providing full execution authority on the underlying application stack. The vulnerability stems from a missing validation filter, aligning with CWE‑434, and could lead to disclosure, integrity, or availability compromise for every user following a successful upload.

The Wiguard WordPress theme is vulnerable in all releases prior to version 2.0.1, including those still installed on sites that have not applied the latest update. Any WordPress installation using one of those older builds is affected.

The CVSS score of 9.9 classifies this as a critical flaw. EPSS indicates an exploitation probability of under 1 %, but that does not eliminate risk. The vulnerability is not listed in CISA KEV. Attackers can exploit it through the theme’s file‑upload interface, which, if accessible to authenticated or unauthenticated users, can lead to remote code execution without additional system access. Because the flaw allows the placement of executable code on the web server, an attacker who can upload can then run code with the permissions of the web application.