The vulnerability is an unauthenticated arbitrary file upload that allows attackers to place any file type, including a web shell, in the WordPress Masteriyo LMS plugin directory. This flaw, identified as CWE-434, could enable the execution of malicious code on the server, giving attackers remote code execution capabilities and full compromise of the site.

WordPress sites running the ThemeGrill Masteriyo – LMS plugin version 2.3.2 or earlier are affected. The vulnerability is present in all builds of the plugin up to 2.3.2, regardless of the WordPress core version, and refers to the product ThemeGrill:Masteriyo – LMS.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of < 1% shows a very low but non‑zero chance of exploitation. The lack of a KEV listing does not reduce the risk. The path to exploitation is a straightforward file upload request that bypasses authentication checks, suggesting that the vulnerability can be triggered remotely with minimal technical effort. Attackers can then upload a web shell to the server and invoke it through the web interface.