An error in the TemplateSpare WordPress plugin allows an authenticated administrator to upload any file to the server without validation. Once uploaded, a malicious file, such as a PHP script or web shell, can be executed, giving an attacker full control over the affected WordPress site and potentially the underlying server. The weakness is a classic External Input Validation failure, categorized as CWE‑434.

The vulnerability affects the Templatespare TemplateSpare WordPress plugin versions up to and including 4.2.0. Any WordPress installation using these versions and having an administrator account is susceptible.

The CVSS score of 9.1 indicates critical severity. EPSS is not available, but the flaw is marked as not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The likely attack vector is an authenticated administrator exploiting the upload feature, which may require the attacker to gain admin credentials or compromise the administrator account.