The vulnerability resides in the Squeeze WordPress plugin before version 1.7.12, where an upload_files-capable user – that is, an Author or higher – can upload an image through an attachment‑update action without any validation of the file type or extension. This omission allows the user to write an arbitrary PHP file to the uploads directory, giving the attacker full remote code execution on the site.

WordPress sites running the Squeeze plugin with any version prior to 1.7.12 are affected. The vendor is the plugin author Squeeze. No specific version numbers are listed aside from the knowledge that 1.7.12 is the first secure release.

The impact is full remote code execution, with a CVSS score of 8.8 indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not recorded in CISA’s KEV catalog. The attack vector requires a legitimate upload_files capability, which many site authors have. Because the flaw allows uploading an arbitrary PHP file to the uploads directory, an attacker can compromise the entire WordPress installation once exploited.