Technical impact
The Personal QR Message WordPress plugin through version 1.0 fails to restrict uploaded file types. An attacker can upload any file, including executable PHP scripts, that is later served directly by the web server. Once uploaded, the script can be accessed and executed, giving the attacker full control over the host. This flaw provides a direct path to compromise confidentiality, integrity, and availability of the affected WordPress site.
Affected Systems
Any WordPress installation that has the Personal QR Message plugin installed and operating on version 1.0 or earlier is affected. The vendor is listed as an unknown entity and the plugin is typically used to generate QR codes for messages on the site.
Risk and Exploitability
Because the vulnerability permits arbitrary PHP files to be uploaded without authentication and accessed directly via HTTP, it can lead to remote code execution. However, the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The CVSS score of 9.8 reflects a critical severity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to interact with the unsecured upload endpoint provided by the plugin.
