The Developer Tools WordPress plugin contains an unauthenticated arbitrary file upload vulnerability due to insufficient validation of the file type and location in the embedded SWFUpload component. An attacker can upload any file to the server without authentication. This flaw exposes the site to abuse of the upload functionality, as files may be placed in a web‑accessible directory.

WordPress sites running the Developer Tools plugin up to and including version 1.1.3 are impacted. The vulnerability is present in all installations of the plugin bundled with the SWFUpload component during that version range.

The vulnerability has a CVSS score of 9.8, indicating critical severity. EPSS data is not available, so the particular likelihood of exploitation cannot be quantified. However, the lack of authentication and the presence of an upload endpoint strongly suggest that an attacker could exploit this flaw readily. The vulnerability is not listed in the CISA KEV catalog at this time, but it remains a high‑priority concern.