The vulnerability is an unauthenticated arbitrary file upload flaw that allows an attacker to store files of any type on the web server. Based on the description, it is inferred that if the uploaded file is a malicious script, it could be executed in the context of the web application, effectively granting remote code execution. This flaw is classified as CWE‑434 because it results from insufficient validation of upload content.

The flaw affects the WordPress Type Hub plugin version 2.0.6 and earlier, provided by the vendor Brandexponents. Any WordPress site that has this plugin installed and has not applied a later update is susceptible.

The CVSS score of 10 reflects a critical impact with full remote exploitation potential. Although an EPSS score is not available, the absence of a KEV listing does not reduce the urgency; the flaw remains feasible for attackers to exploit without authentication. It is inferred that an attacker can upload a crafted payload through the plugin’s interface and then trigger it by visiting the uploaded file URL.