The midi‑Synth WordPress plugin allows unauthenticated users to upload arbitrary files because the AJAX action "export" lacks file type and extension validation. The nonce required for the request is exposed in client‑side JavaScript, making it trivial to obtain. Based on the description, it is inferred that a malicious upload that places executable code on the server could enable remote code execution. This flaw is enumerated as CWE‑434.

The vulnerability affects the midi‑Synth plugin from the vendor adminkov, to all release versions up to and including 1.1.0. Users running any of these versions on a WordPress site are susceptible unless a newer release is installed.

The CVSS score of 9.8 classifies the issue as critical. An EPSS score of 27% indicates a relatively high probability that attackers target this weakness. Based on the description, the exploitation path—POSTing to the export endpoint with a valid nonce—is straightforward, as the nonce is publicly available on the front‑end. Consequently the risk remains high regardless of the KEV status.