Technical impact
The vulnerability allows attackers to create arbitrary files on the server without authentication. Because the plugin concatenates a Google Drive file name into a local path without sanitizing or canonicalizing the value, a file whose name contains path traversal sequences can be written outside the intended downloads directory. If the attacker supplies a Google Drive credential pointing to a file with a “.php” extension, the resulting PHP file may land in a web‑accessible location and be executed by the server, giving the attacker full remote code execution.
Affected Systems
The affected product is the WordPress plugin Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads, released by fluentwiz. All versions up to and including 1.2.0 are impacted, and the issue resides in the missing authorization on the connection/{driver}/save and /download/single-file REST endpoints combined with insecure path handling.
Risk and Exploitability
The CVSS base score of 9.8 indicates a high‑severity flaw. The EPSS score is not available, but the lack of authorization checks means the attack vector is unauthenticated and any web site installing the vulnerable plugin is susceptible. Because the vulnerability is not listed in the CISA KEV catalog, it may not yet have widespread exploitation, yet the combination of unauthenticated access, path traversal, and the ability to drop executable code into a public directory makes exploitation highly probable for motivated adversaries.
