A critical remote code execution vulnerability in the teddy-bear-customize-addon WordPress plugin allows unauthenticated attackers to achieve full system compromise.

This flaw stems from improper file validation where the plugin relies on client-supplied content types and retains original filenames during uploads. This permits unauthenticated attackers to upload malicious PHP scripts that execute within the server context.

The ability for an unauthenticated attacker to execute arbitrary code provides them with full control over the affected web server. This risk is classified as critical with a CVSS score of 10.0, as it leads to potential data exfiltration, complete system takeover, and the use of the compromised server as a pivot point for further network infiltration.

Immediate Action: As no official patch is currently identified, immediately deactivate and remove the teddy-bear-customize-addon plugin from all WordPress installations until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for requests targeting file upload directories or suspicious file extensions, such as .php, being accessed directly from the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict access to executable files within the WordPress upload directories.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the ease of exploitation, immediate removal of the affected plugin is required to protect the integrity of the environment. Organizations should maintain a strict policy of disabling unpatched or abandoned software to prevent unauthorized code execution and complete system compromise.