This vulnerability arises from missing capability checks, nonce verification, and file‑type validation during file upload, allowing unauthenticated actors to place arbitrary PHP code on the server. By uploading a crafted file to any chosen path, an attacker can execute code with the privileges of the web application, compromising confidentiality, integrity, and availability of the site.

The affected product is the Anton Extensions WordPress plugin, any installation of version 1.2.2 or earlier.

The flaw can be exploited without authentication or any special pre‑conditions, creating a high‑risk scenario for remote code execution. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. However, the lack of any mitigation or authentication requirement implies a clear exploitation path and a substantial likelihood of misuse. The CVSS score of 9.8 indicates a critical severity of risk.