The WHMCS Bridge plugin for WordPress contains a CWE‑434 flaw where the connect() function accepts files uploaded through the 'ccce' parameter without validating its MIME type or extension. An attacker who possesses at least Custom‑level WordPress credentials can therefore upload any file, and if that file is executable on the server, the attacker can run it. This provides a direct path to remote code execution, compromising the confidentiality, integrity and availability of the site.

All WordPress sites that have the WHMCS Bridge plugin version 6.9 or earlier installed by globalprogramming are affected. The vulnerability applies to any deployment that has not upgraded beyond 6.9 and where the plugin’s upload feature remains enabled.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread, and the issue is not listed in CISA’s KEV catalog. However, it requires authentication; an attacker must first compromise the WordPress site or obtain legitimate Custom‑level access. Once an arbitrary file is accepted, the attacker can execute it, enabling full code execution on the server.