The Ebook Store plugin for WordPress permits unauthenticated users to upload arbitrary files because it lacks file type validation, allowing an attacker to upload a malicious script that may be executed on the server. This flaw is a classic instance of unrestricted file upload (CWE‑434) and gives the attacker the ability to run code with the privileges of the web server process.

All installations of the Ebook Store plugin by motovnet with versions up to and including 5.8012 are affected. The vulnerability resides in the ebook_store_save_form function and any WordPress site that has not applied a newer version is at risk. The plugin is typically used by e‑book retail or distribution sites.

The vulnerability scores a CVSS of 9.8, indicating critical severity. The EPSS score is less than 1 %, showing a very low but non‑zero exploitation probability, and it is not listed in the CISA KEV catalog. The attack vector is inferred as a web‑application path; an unauthenticated user can issue an HTTP request to the plugin’s upload endpoint and supply any file type. Because no validation occurs, malicious executable files can reach the server’s document root, after which they can be accessed or executed, leading to remote code execution.