The WP Libre Form plugin does not validate the type of files uploaded through its form submissions, a MIME‑type and file‑extension validation flaw (CWE‑434). This allows an unauthenticated attacker to upload a PHP file to a web‑accessible location and execute it. This flaw permits the attacker to run arbitrary code on the server, giving full control over the WordPress installation and the underlying operating system.

WordPress sites that have the WP Libre Form plugin installed at version 1.5.0.1. No other versions or products are confirmed to be affected by this specific vulnerability.

The CVSS score of 10 signals a critical severity level. The EPSS score is not provided, but the lack of mitigation in the plugin and the absence of a KEV listing do not reduce the risk; rather, attackers could exploit the flaw through a simple unauthenticated file upload. With the vulnerable form endpoint exposed, an attacker can upload a PHP file to a web‑accessible directory and execute it, achieving remote code execution without the need for additional privileges or authentication.