A critical vulnerability in the Webinfos WordPress plugin allows unauthenticated attackers to execute arbitrary code on the host server via unrestricted file uploads.

This vulnerability involves an unrestricted file upload flaw where the plugin fails to perform necessary validation on file types or names, and lacks authentication or capability checks on the upload function. This permits unauthenticated attackers to remotely upload and execute malicious PHP scripts within the web-accessible directory.

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows full system compromise without requiring any user interaction or authentication. Successful exploitation leads to complete remote code execution, which can result in total data exfiltration, permanent site defacement, and the installation of persistent backdoors within the hosting infrastructure.

Immediate Action: Update the Webinfos plugin to a version greater than 1.2 immediately. If an update is not available, deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Monitor server access logs for requests directed at the plugin upload directory or unexpected file creation events.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict access to plugin-specific directories.

Public Exploit Available: No

This vulnerability presents a severe risk to the integrity and confidentiality of the affected WordPress site. Administrators must prioritize updating the plugin to the latest version, as the ease of exploitation and the potential for full system control necessitate immediate remediation.