The BerqWP plugin allows arbitrary files to be uploaded because store_javascript_cache.php does not perform file type validation. An unauthenticated attacker can place malicious code on the server; the vulnerability falls under CWE-434. If a PHP script or other executable file is uploaded, the attacker may obtain remote code execution on the victim’s web server.

WordPress sites that have the BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin installed in any version up to and including 2.2.42.

The CVSS score of 8.1 highlights high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at present. The plugin’s endpoints are reachable without authentication, providing an unauthenticated attack vector that could allow an attacker to upload executable files and execute them on the server. The vulnerability is not listed in the CISA KEV catalog.