The giftware WordPress plugin before version 4.2.10 fails to validate the file type for one of its upload paths, allowing an unauthenticated user to upload any file, including PHP code. A successfully uploaded PHP file can be executed on the site, giving an attacker the ability to read or modify data, install backdoors, or perform further malicious actions. This flaw directly leads to remote code execution, the highest class of impact for a web application vulnerability. The weakness can be categorized as an unrestricted upload of dangerous content or inappropriate code generation control, aligning with standards such as CWE‑434. The description itself indicates that the affect is without authentication, thereby providing a broader attack surface.

This vulnerability applies to the "giftware" WordPress plugin, specifically versions earlier than 4.2.10. Users running any version of the plugin before the 4.2.10 release are exposed until the plugin is updated to a version that includes the file type validation fix.

Because the bug allows file uploads from unauthenticated users, the likely attack vector is via the web interface of the plugin. An attacker can upload a crafted PHP script and immediately trigger it to achieve full remote code execution on the target server. The CVSS score of 9.8 indicates a critical severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, yet the potential impact remains significant. Immediate attention is warranted, as the flaw can be exploited by anyone with network access to the WordPress installation.