The vulnerability resides in the Squeeze WordPress plugin before version 1.7.12, where an upload_files-capable user – that is, an Author or higher – can upload an image through an attachment‑update action without any validation of the file type or extension. This omission allows the user to write an arbitrary PHP file to the uploads directory, giving the attacker full remote code execution on the site.

WordPress sites running the Squeeze plugin with any version prior to 1.7.12 are affected. The vendor is the plugin author Squeeze. No specific version numbers are listed aside from the knowledge that 1.7.12 is the first secure release.

The impact is full remote code execution, a high‑severity condition. No EPSS score is available, and the flaw is not currently listed in CISA’s KEV catalog. The attack vector requires legitimate upload_files capability, which many site authors possess. Because the vulnerability permits execution of arbitrary PHP files, once exploited the attacker can compromise the entire WordPress installation.