The vulnerability is an arbitrary file upload flaw where the plugin accepts files of dangerous MIME types without proper validation, enabling an attacker to upload executables or scripts. As a result, the attacker can execute code on the hosting server, compromising confidentiality, integrity, and availability. This weakness aligns with CWE‑434: Unrestricted Upload of File with Dangerous Type.

Any WordPress site running the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin under version 4.4.1 or earlier is affected. The plugin is distributed by WP Legal Pages and is commonly deployed to manage cookie consent banners. The vulnerability exists in all versions from the earliest release through 4.4.1.

The CVSS score of 10 indicates a critical severity. The EPSS score is not reported, so exploitation probability cannot be quantified but the absence of a KEV listing means there is no known public exploitation yet. The likely attack path is through the plugin’s file‑upload interface, which an attacker can exploit remotely if they have authenticated or unauthenticated access to the upload endpoint. Because the flaw permits unrestricted file types, a successful exploitation would grant the attacker code execution on the server.