An unrestricted file upload vulnerability in the RTMKit WordPress plugin allows attackers to execute arbitrary code, necessitating an immediate update to version 1.6.6.

The plugin fails to properly validate file types during the upload process. Per the CVSS vector (PR:L), this vulnerability requires an authenticated user with low-level privileges to initiate the upload, which can then be used to achieve remote code execution.

Exploitation of this flaw grants an attacker the ability to upload web shells or malicious scripts, leading to full site compromise, data theft, or complete loss of server control. With a high CVSS score, this vulnerability represents a significant risk to any WordPress environment utilizing this plugin.

Immediate Action: Update the RTMKit plugin to version 1.6.6 or later immediately via the WordPress dashboard or vendor site.

Proactive Monitoring: Review web server access logs for suspicious file uploads or access patterns originating from non-administrative user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block suspicious file upload attempts and restrict file execution permissions in the WordPress uploads directory.

Public Exploit Available: Unknown.

This vulnerability is critical for any WordPress site using the RTMKit plugin. Administrators should verify their current version and patch to 1.6.6 without delay to prevent potential compromise of the underlying server infrastructure.