The vulnerability permits an attacker to upload any file type, including executable web shells, to a WordPress site. This flaw originates from insufficient file type validation (CWE-434) and, if a malicious script is uploaded, can result in remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

WP Chill Filr plugin, versions n/a through 1.2.14, installed on WordPress websites.

With a CVSS score of 8.5, the flaw is considered high severity. The EPSS score of less than 1% suggests exploitation is currently unlikely, yet the presence of an unauthenticated upload interface indicates that a remote attacker could exploit it by simply sending a specially crafted request to the plugin’s upload endpoint. The vulnerability is not listed in CISA’s KEV catalog, but the potential for remote code execution warrants proactive mitigation.