The mView WordPress plugin for the 豆瓣电影 site (versions up to 1.0.3) fails to validate the type, name, or source of files fetched remotely and does not check user capability or authorization before saving them to a web-accessible directory. This flaw allows any authenticated subscriber to upload arbitrary PHP files, a path that grants full remote code execution on the host. The vulnerability is a classic example of insecure file upload and missing access control.

The flaw exists in the mView plugin (Douban Movie WordPress plugin) for versions 1.0.3 and earlier. Any WordPress installation that has this plugin with a subscriber account or equivalent role is vulnerable.

The vulnerability is severe, offering attackers unauthenticated execution of code once they are logged in as a subscriber. The EPSS score is not available and the bug is not listed in the CISA KEV catalog, but the lack of input validation and authorization checks creates a high likelihood of exploitation in targeted installations. The attack vector is inferred to be the plugin’s file upload interface accessed via the WordPress admin area; an attacker with subscriber credentials could simply upload a malicious PHP script and then navigate to it to execute arbitrary code.