The plugin Gerador de Certificados – DevApps for WordPress contains an arbitrary file upload vulnerability because the moveUploadedFile() function does not validate file types. Attackers who can authenticate with Administrator or higher privileges can upload any file to the server, and by placing a web‑accessible script, may achieve remote code execution. The flaw represents a classic file upload weakness (CWE‑434) and compromises the integrity and potential confidentiality of the site.

The vulnerability affects the WordPress plugin Gerador de Certificados – DevApps from the vendor tidevapps, in all releases up to and including version 1.3.6. Users running these or earlier versions are exposed.

The CVSS base score of 7.2 indicates a moderate to high severity when the conditions are met. The exploit requires authenticated access with Administrator privileges, making the attack vector internal and limited to privileged users. No public exploit indicators or KEV listing are currently available, and EPSS data is missing, so the likelihood of exploitation today is uncertain, but the potential for serious impact remains if an administrator can be coerced or compromised.