The vulnerability allows super_admin users to upload a crafted ZIP file to the plugin upload endpoint. Once uploaded, the plugin’s plugin.php and public/index.php files contain arbitrary PHP code that runs as the web server user. This can lead to full compromise of the affected site, including data exfiltration, defacement, and installing backdoors. It is a classic Unrestricted File Upload flaw (CWE-434) combined with path traversal (CWE-61).

The affected vendor is givanz, product Vvveb. Versions prior to 1.0.8.3 are vulnerable. Anyone running an older Vvveb build and having super_admin rights can exploit this.

The CVSS score of 8.6 indicates high severity. EPSS is not available, so the exploitation probability remains uncertain, but the known exploitation path is straightforward: an attacker with administrative credentials uploads a malicious ZIP, then visits the public path to trigger the code. The vulnerability is not listed in CISA KEV, implying no known targeted exploitation yet. Nevertheless, the ability to run arbitrary code via a web request makes this a critical risk for exposed installations. The attack vector likely originates from authenticated super_admin actions, but once the plugin is uploaded, the code can be triggered via unauthenticated HTTP calls.