A critical arbitrary file upload vulnerability in the Post By Email WordPress plugin allows unauthenticated attackers to execute remote code on the affected server.

This vulnerability stems from missing file type validation within the save_attachments function. It allows an unauthenticated attacker to upload malicious files to the server, which facilitates remote code execution.

The CVSS score of 9.8 reflects the high severity of this flaw, as it permits full system compromise without requiring user interaction or authentication. Successful exploitation could lead to total loss of confidentiality, integrity, and availability, potentially resulting in complete server takeover and persistent access for malicious actors.

Immediate Action: Since no patched version is currently available, administrators should immediately deactivate and remove the Post By Email plugin from all WordPress installations.

Proactive Monitoring: Review web server access logs for requests targeting the plugin directory or unusual file upload patterns, specifically looking for extensions that deviate from standard media formats.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to the plugin's functional endpoints until a security update is released.

Public Exploit Available: No (exploit_available: unknown)

Given the critical nature of this vulnerability and the lack of a verified patch, immediate removal of the plugin is the only effective way to eliminate the risk. Security teams should prioritize this action to prevent potential remote code execution by unauthenticated external actors.