The Gpx2Graphics WordPress plugin through version 0.3 lacks a CSRF check and does not validate uploaded file types, allowing an attacker to trick a logged‑in administrator into uploading arbitrary files such as PHP scripts. This flaw, a CWE‑352 cross‑site request forgery and a CWE‑434 arbitrary file upload, enables the execution of code on the web server, giving the attacker full control over the site’s file system and potentially the underlying server environment. The impact is the ability to execute malicious code and compromise the entire application.

The vulnerable component is the Gpx2Graphics WordPress plugin, the installer is not tied to a vendor name but is available to administrators of any WordPress site that has installed this plugin. The vulnerability applies to any WordPress deployment where the plugin is active and administrative sessions are either unattended or subject to social engineering.

The vulnerability results in a serious security risk because it enables remote code execution through a CSRF attack that requires the victim to be an authenticated administrator. While the EPSS score is less than 1%, the lack of a KEV listing does not mitigate the severity. Attackers can craft a link or embed a malicious form that, when accessed by an administrator, submits a file upload request. Because no file type validation exists, arbitrary PHP files are accepted, leading the absence of a timely patch, and the attacker only needs to lure the administrator into visiting a crafted URL or page.