This vulnerability allows an attacker to upload a file of any type through the plugin’s upload interface. The upload mechanism does not enforce type restrictions, permitting a web‑shell file to be placed on the server. Deployment of such a file gives the attacker the ability to execute arbitrary commands on the web server, compromising confidentiality, integrity, and availability of the site.

WordPress users running the Mobile App Editor plugin from the Syarif collection, versions up to and including 1.3.1, are affected.

The EPSS score is below 1% and the vulnerability is not listed in the KEV catalog, yet the impact is high because it enables remote code execution. An attacker could exploit the flaw simply by using the public upload feature of the plugin, likely without advanced prerequisites. The combination of unrestricted file upload and the ability to store a web shell creates a direct attack vector that, if used, can lead to full server compromise.