A critical vulnerability in the weDevs User Frontend WordPress plugin allows authenticated attackers to perform arbitrary file uploads, posing a severe risk of remote code execution.

This flaw involves improper validation of file types during the upload process within the WPUF_Admin_Settings and Admin_Tools classes. Authenticated attackers with Author-level access or higher can bypass restrictions to upload malicious files, which may lead to full system compromise.

The ability to upload arbitrary files permits an attacker to execute malicious scripts on the web server, leading to a complete compromise of the WordPress environment. Given the high CVSS score of 8.8, this vulnerability represents a significant risk to data integrity, confidentiality, and overall service availability. Unauthorized code execution can facilitate data exfiltration, site defacement, or the deployment of persistent backdoors.

Immediate Action: Update the User Frontend plugin to version 4.2.9 or the latest available release immediately to apply the necessary file type validation patches.

Proactive Monitoring: Review web server access logs for unusual file upload requests or attempts to access newly created files within the plugin upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing prohibited extensions or suspicious content types until the plugin can be patched.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate attention from all administrators utilizing the affected WordPress plugin. Because the exploit requires only Author-level credentials, the attack surface is wide, and the impact is total. Patching the plugin is the only definitive method to secure the environment against potential remote code execution.