The AMP for WP – Accelerated Mobile Pages plugin contains unsafe ZIP extraction logic in the ampforwp_save_local_font() function that fails to delete nested directories. This allows an authenticated user with Author role or higher to upload a ZIP archive that writes arbitrary files to the WordPress uploads folder, which is web‑accessible. If the uploaded file contains PHP, a visitor to the site could execute the script, resulting in remote code execution on the host. The weakness is a classic path traversal flaw, identified as CWE‑73.

WordPress installations running the AMP for WP – Accelerated Mobile Pages plugin version 1.1.12 or earlier are affected. Any user who holds at least Author authority and has permission to use the local font upload feature can trigger the flaw. The issue exists in the plugin’s local font configuration page and is limited to plugins of that version range.

The CVSS score of 7.5 indicates high impact, but the EP than 1 % suggests a low probability of widespread exploitation currently. The vulnerability is listed outside the CISA KEV catalog. Successful exploitation requires valid credentials with at least Author level and access to the font upload configuration; any authenticated attacker can then place a PHP file in the uploads directory and trigger execution via a remote visitor. The likely attack vector is authenticated local file upload and may proceed once the attacker gains access to the site’s admin area.