The vulnerability is an insecure plugin upload feature that permits attackers to upload and execute arbitrary PHP code, allowing complete compromise of the affected web server. This leads to remote code execution, unauthorized modification of site content, and persistent backdoor installation. The weakness arises from insufficient validation of uploaded file types, classified as CWE‑434. Successful exploitation results in full system control by the attacker. The flaw directly compromises confidentiality, integrity, and availability of the server hosting the site.

emlog website building system is affected. All installations of emlog version 2.6.10 or earlier are vulnerable. The vulnerability exists in the plugin upload component of emlog prior to the release of version 2.6.11.

The issue is a true remote code execution flaw that can be exploited by uploading a deliberately crafted plugin. An attacker must first access the plugin upload interface, which is typically restricted to site administrators. The EPSS score is not available, but the lack of file type restrictions and the ability to run arbitrary code indicate a high likelihood of exploitation. The flaw is not listed in the CISA KEV catalog; however, the potential impact warrants urgent remediation.