An unrestricted upload of arbitrary files can be performed by any user with upload privileges. Uploaded files are not validated for type or content, enabling an attacker to place a web shell onto the server. Once the shell is present, the attacker can execute arbitrary code with the web server's user rights, leading to full system compromise. The weakness corresponds to CWE‑434, which signals a lack of validation for uploaded data.

The vulnerability affects the Miion theme from zozothemes, with all releases from the initial launch through version 1.2.7. Specifically any installation of Miion version 1.2.7 or older is potentially exploitable.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not currently listed in CISA’s KEV catalog, but the possibility of deploying a web shell remains high. The likely attack vector is through the web interface of the WordPress site, where a malicious actor uploads a valid‑looking file that contains executable code.