The vulnerability resides in the gutenbee_file_and_ext_json function of the GutenBee – Gutenberg Blocks plugin. A flawed strpos check accepts filenames containing the substring ".json" even when the real extension is not .json, permitting double‑extension names such as shell.json.php. This flaw allows an authenticated user with Author or higher privileges to upload arbitrary files that may execute on the server, leading to remote code execution and compromising confidentiality, integrity, and availability of the WordPress site.

Vulnerable versions include all releases of the GutenBee – Gutenberg Blocks plugin up to and including 2.20.1. The plugin is installed on WordPress sites; any site that has deployed a vulnerable version is at risk. Core WordPress and other plugins are not directly affected by this flaw.

The CVSS score of 8.8 indicates high severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw remains a serious threat. Any site that is publicly accessible and has an authenticated author or higher user can exploit the flaw to upload and execute malicious code. The risk is compounded by the lack of a public exploit, meaning that attackers may exploit it before any patches are widely applied.