The flaw in the Quform plugin for WordPress allows the uploading of any file type because the plugin does not verify file MIME type or extension, a weakness classified as CWE‑434. An attacker who can submit a form can place a file on the web server without restrictions. Based on the description, it is inferred that if the web server later serves the uploaded file in a context that executes code—such as a PHP file in an accessible directory—then remote code execution could be achieved, potentially compromising the site’s confidentiality, integrity, and availability.

ThemeCatcher’s Quform plugin for WordPress versions up to and including 2.23.0 is affected. Any WordPress site that has this plugin installed and uses the default file upload field can be vulnerable.

The CVSS score of 9.9 marks this vulnerability as critical. EPSS data are not available, so the exact probability of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. The likely attack vector is via a publicly accessible form endpoint that accepts file uploads; no authentication is required beyond submitting a request. Attackers could supply a malicious file, which, if processed by the server, could lead to unauthorized code execution.