The WPForms Pro plugin for WordPress accepts file uploads through an Ajax endpoint that reconstructs a file from chunks. The plugin performs file‑type validation only after the file data has already been written to disk, and the temporary assembled file is not removed if validation fails. This allows an unauthenticated attacker to upload a file that may be executable, giving the attacker the ability to execute arbitrary code on the server. The flaw is a classic example of unrestricted file upload weaknesses (CWE‑434) and could be used to place malicious files with executable permissions on a web host.

WPForms Pro for WordPress up to and including version 1.10.1.1 is affected. Any WordPress installation that has that plugin installed and not updated beyond 1.10.1.1 is vulnerable, regardless of other security configurations.

The vulnerability carries a CVSS base score of 8.1, indicating high severity. The EPSS score is reported as less than 1%, so the statistical likelihood of exploitation in the near term is considered low, but the potential impact remains serious because RCE can be achieved from any unauthenticated web request. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only access to the public Ajax upload endpoint and submit a crafted request, which can be performed from a web browser or simple HTTP client without special privileges.