The WP FOFT Loader plugin allows authenticated users with Author-level access to upload files to the server without proper type validation. This flaw can be leveraged to place malicious files on the site, creating a pathway for remote code execution. The weakness is a classic example of invalid file type validation (CWE-434). The result is a compromise of integrity and the possibility of executing arbitrary code on the host. The impact is immediate and severe, affecting both confidentiality and availability if the attacker gains further access.

WordPress sites using the WP FOFT Loader plugin from the vendor seezee. Any installation of the plugin up to and including version 2.1.39 is susceptible. Sites that have not upgraded beyond this version remain at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack vector is authenticated; an attacker must have Author or higher access to the WordPress site to exploit the flaw. Once authenticated, the attacker can upload arbitrary files, potentially leading to remote code execution if other conditions are satisfied.