The Post By Email WordPress plugin allows any unauthenticated user to upload files because the save_attachments function does not validate the file type. This flaw, classified as CWE-78, lets an attacker place arbitrary files—including executable scripts—onto the web server. Once on the server, those files can be accessed via a browser, enabling remote code execution or other malicious actions.

WordPress sites that use the Post By Email plugin version 1.0.4b or earlier are affected. The plugin is available as a WordPress Core plugin and is listed under the vendor "westi".

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is below 1% but not zero, suggesting that exploitation is low probability but still possible. The vulnerability is not listed in CISA KEV. The attack vector is remote and unauthenticated: an attacker sends an email with a malicious attachment to the site’s configured email address, the plugin stores the attachment without checks, and the attacker later accesses it through a browser to execute code.