The teddy-bear-customize-addon plugin allows any visitor to upload files without proper validation. The server trusts the client-supplied content type and preserves the filename, enabling the upload of malicious PHP code that can be executed on the server. The weakness corresponds to uncontrolled file upload (CWE‑434), giving attackers the ability to compromise the confidentiality, integrity, and availability of the site.

The vulnerability affects the WordPress plugin teddy‑bear‑customize‑addon for all installations running version 1.0.5 or older. No other vendor or product versions are listed as affected in the CNA data.

Because authentication is not required, the attack vector is the public-facing file upload interface of the plugin. While no EPSS score is available, the potential for remote code execution is high and the vulnerability is not listed in the CISA KEV catalog. An attacker can simply craft a PHP payload, upload it, and then trigger execution by accessing the file’s URL, leading to full server compromise.