The Webinfos WordPress plugin through version 1.2 fails to validate the type or name of files that an unauthenticated user can upload, and the upload feature lacks any authentication, capability, or nonce checks. This flaw permits an attacker to place arbitrary files, including executable PHP scripts, into a publicly accessible directory. If the server processes PHP from that location, the attacker can execute code on the server, compromising confidentiality, integrity, and availability.

This issue affects any WordPress installation that uses the Webinfos plugin version 1.2 or earlier. The plugin is identified as Webinfos; no specific vendor publishes an update for this version range, but users of the affected plugin are at risk.

The vulnerability offers remote code execution without requiring any credentials, making it highly attractive to attackers. The EPSS score is < 1% and the CVSS score is 9.8. The vulnerability is not listed in CISA's KEV catalog, suggesting that while the flaw is known, there may be limited publicly available exploits at present. Nevertheless, the lack of authentication combined with the ability to execute arbitrary code ranks the risk as high. Remediation should be performed immediately to avoid potential exploitation.