The WpStream plugin, when installed at a version lower than 4.11.2, permits an attacker to upload any file to the server through the plugin’s web interface. The vulnerability falls under CWE-434, meaning that the plugin accepts arbitrary file types without proper validation, which can be exploited to upload PHP or other executable scripts. Once the malicious file is on the server, the attacker can run it, leading to loss of confidentiality, integrity, and availability of the site and potentially the underlying server.

Any WordPress installation that has the sc Internet Vivoo WpStream plugin version below 4.11.2 is affected. Sites that rely on the plugin for media handling or file streaming are especially at risk if they allow regular site users to upload content.

The CVSS score of 5.4 indicates a moderate impact with a user interacting via the web. The EPSS score of less than 1% suggests that exploitation likelihood is very low, and the vulnerability is not currently listed in the CISA KEV catalog. However, because the flaw allows file uploads from users with subscriber-level permissions, a remote attacker who can reach the site could exploit the flaw; once a malicious script is uploaded, remote code execution can occur. The problem is mitigated by applying the official solution of updating the plugin to version 4.11.2 or later.