This vulnerability allows an attacker to upload any type of file through the Green Downloads plugin on WordPress sites without validating MIME type or file extension. Because the plugin stores the uploaded files on the server, a malicious actor could place executable code or otherwise dangerous content that, once accessed, could compromise the site. The weakness is identified as CWE‑434, which represents an Input Validation vulnerability that permits the upload of dangerous files.

WordPress installations that have the halfdata Green Downloads plugin version 2.08 or earlier are affected. The upload functionality of the plugin can be reached by users who have the necessary privileges in the WordPress administration interface, providing a path for an attacker to place files on the server.

The CVSS base score of 9.9 categorizes this flaw as critical. Although no EPSS value is available, the high severity score and the fact that the vulnerability exists in a widely used WordPress plugin suggest that exploitation is likely. The vulnerability is not listed in the CISA KEV catalog, but this does not reduce the inherent risk. Based on the description, it is inferred that the attack vector is remote exploitation through the plugin's file upload interface, which can be accessed by authenticated users with sufficient privileges.