The Enable SVG, WebP, and ICO Upload plugin for WordPress is affected by a critical arbitrary file upload vulnerability that could allow an authenticated attacker to execute remote code.

This flaw is an unrestricted file upload vulnerability (CWE-434) caused by inadequate validation of ICO files. An authenticated attacker with author-level access or higher can upload malicious files to the server by bypassing sanitization checks.

Successful exploitation of this vulnerability allows an attacker to upload arbitrary files, which can lead to remote code execution on the underlying WordPress server. Given the CVSS score of 8.8, this represents a high-severity risk that could result in full site compromise, unauthorized data access, and potential lateral movement within the hosting environment.

Immediate Action: Update the Enable SVG, WebP, and ICO Upload plugin to the latest version (1.1.4 or higher) as identified in the vendor changelog. If an update is not immediately available, disable or remove the plugin until a patch is applied.

Proactive Monitoring: Review media library upload logs for unusual file types or suspicious file naming conventions. Monitor server file integrity for unexpected scripts appearing in the uploads directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict file uploads to authorized extensions and block requests that attempt to bypass MIME type validation.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to WordPress site integrity due to the potential for remote code execution. Administrators should prioritize updating the plugin immediately to the latest version to prevent exploitation. If the plugin is not strictly necessary for site operations, its removal is the most effective way to eliminate the attack surface entirely.