The vulnerability in WPJAM Basic allows an attacker to upload files without restriction. An attacker can upload a file with a dangerous payload, such as PHP code, enabling the execution of arbitrary code and full compromise of the affected WordPress site. The weakness corresponds to CWE-434 Unrestricted File Upload.

WPJAM Basic plugin from vendors denishua, version 6.9.2 and earlier are affected. The problem exists in all versions up to and including 6.9.2.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score below 1% suggests a low current exploitation probability. The vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, the attack vector is likely through the plugin’s upload interface, probably requiring a user with administrative or author privileges to exploit. Exploitation would allow uploading arbitrary code that could be executed on the server, granting full control of the web site.