The vulnerability in the MagicForm WordPress plugin permits an attacker to upload arbitrary files, including PHP scripts, because file type validation is bypassed when the per-field extension allowlist is empty. By exploiting the unauthenticated AJAX action, an attacker can place malicious code on the server, leading to remote code execution and full control of the affected WordPress installation.

Any WordPress site that has the MagicForm plugin installed with version 0.1.3 or earlier is vulnerable. The plugin vendor is listed as Unknown:MagicForm, and the flaw exists specifically in all releases up to and including 0.1.3. No specific version range beyond that is documented, so any site using an affected revision must update.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, and the EPSS score is below 1%, implying a low current exploitation probability. It is not listed in the CISA KEV catalog. The attack can be carried out remotely with no authentication, via HTTP requests to the plugin's AJAX endpoint, and an attacker only needs to craft a request that bypasses the empty extension allowlist. Once a PHP file is uploaded, arbitrary code can be executed on the server.