The WPLP Cookie Consent plugin for WordPress is vulnerable to arbitrary file upload because the saas_upload_logo() function lacks file type validation and the upload-logo REST endpoint is accessible without authentication. This flaw allows an attacker to place any file on the site’s server, potentially including malicious scripts. If such a script is uploaded, the attacker can execute code remotely, compromising the entire WordPress installation and any data it handles.

All WordPress sites running WPLP Cookie Consent version 4.4.1 or earlier are affected. The vulnerability exists across all editions of the plugin that expose the upload-logo endpoint, enabling unauthenticated users to upload files through the REST API.

The flaw carries a CVSS score of 9.8, indicating critical severity. EPSS information is not available, but the lack of authentication combined with the ability to upload any file strongly suggests a high exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, yet attackers can exploit the REST endpoint from any internet‑connected machine. The likely attack vector is over the unauthenticated upload-logo endpoint, which can be accessed remotely by sending a POST request containing the malicious file.