WP Dispatcher, a WordPress plugin, allows authenticated users with Subscriber level access or higher to upload files through the wp_dispatcher_process_upload() function. The function lacks file type validation, permitting arbitrary file uploads. An attacker who can authenticate to the site (e.g., a legitimate subscriber) could upload any file, including potentially executable scripts. Although the upload directory contains an .htaccess file that restricts remote execution, a successful upload could still allow an attacker to place a malicious file that the server might inadvertently execute, leading to remote code execution, data exfiltration, or site defacement.

The vulnerability affects ekndev’s WP Dispatcher plugin for WordPress. All releases up to and including version 1.2.0 are susceptible. The issue exists on any WordPress site that has this plugin installed and grants subscribers the ability to create uploads.

The CVSS score of 7.5 indicates a high risk when exploited, yet the EPSS score of less than 1% signals a low probability of exploitation at this time, and the CVE is not listed in the CISA KEV catalog. Exploitation requires authenticated access, so the attack vector is an authenticated user with subscriber-level privileges. Once an attacker gains upload capability, they could immediately upload a malicious script and potentially trigger remote code execution, depending on the server configuration. This underscores the importance of timely remediation.