A critical arbitrary file upload vulnerability in the WPForms Pro plugin for WordPress allows unauthenticated attackers to achieve remote code execution.

This vulnerability is an unrestricted file upload flaw (CWE-434). It allows an unauthenticated attacker to bypass security controls and upload malicious payloads, which could lead to full site compromise.

Successful exploitation allows an attacker to execute arbitrary code on the underlying server. This poses a severe risk to data confidentiality, integrity, and availability, potentially leading to total site takeover and the exfiltration of sensitive customer or administrative data. Given the CVSS score of 8.1, this represents a high-severity risk that requires immediate attention.

Immediate Action: Update the WPForms Pro plugin to version 2.0.0 or later immediately to apply the patch.

Proactive Monitoring: Monitor server access logs for suspicious file upload activity or requests targeting plugin directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and execution of scripts in upload directories.

Public Exploit Available: No confirmed public exploit exists in our curated sources.

The severity of this flaw necessitates immediate action. Administrators must prioritize updating the WPForms Pro plugin to the latest version to prevent potential remote code execution and full site compromise.