The vulnerability is an administrator endpoint that accepts file uploads without restricting the type or content of the file. Because an attacker can upload any file, uploading a web shell or other malicious code can result in remote execution on the host. This flaw is identified as improper access control (CWE‑284) and unvalidated file upload (CWE‑434). The impact is the ability for an attacker to place malicious code on the server and subsequently execute it, potentially compromising the entire application and its underlying system.

PureBlog by kevquirk up to and including version 3.7.2 is affected. The problem occurs in the file admin/upload-image.php. Version 3.7.3 contains a fix (commit 71f5b0de2ecb2bb2934048ed40e1155c107484e3) and addresses the upload restriction flaw.

The CVSS base score is 5.1, indicating moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack may be launched remotely, implying that an unauthenticated HTTP client can target the upload-image.php endpoint. Given the lack of additional restrictions mentioned, the exploitability is considered likely if the endpoint is reachable and not otherwise protected by blocking or authentication.