The vulnerability allows super_admin users to upload a crafted ZIP file to the plugin upload endpoint. The ZIP includes a plugin.php containing a valid Slug header and a public/index.php file with arbitrary PHP code. When the files are accessed via unauthenticated HTTP requests to the plugin's public path, the code runs as the web server user, giving the attacker full control of the application. This can lead to full compromise of the affected site, including data exfiltration, defacement, and installing backdoors. It is a classic Unrestricted File Upload flaw (CWE-434) combined with path traversal (CWE-61).

The affected vendor is givanz, product Vvveb. Versions prior to 1.0.8.3 are vulnerable. Anyone running an older Vvveb build and having super_admin rights can exploit this.

The CVSS score of 8.6 indicates high severity. The EPSS score of < 1% indicates a very low, but non‑zero likelihood of exploitation, but the known exploitation path is straightforward: an attacker with administrative credentials uploads a malicious ZIP, then visits the public path to trigger the code. The vulnerability is not listed in CISA KEV, implying no known targeted exploitation yet. Nevertheless, the ability to run arbitrary code via a web request makes this a critical risk for exposed installations. The attack vector likely originates from authenticated super_admin actions, but once the plugin is uploaded, the code can be triggered via unauthenticated HTTP calls.