The Personal QR Message plugin for WordPress is vulnerable to unauthenticated remote code execution, posing a critical threat to site integrity and data confidentiality.

This vulnerability is caused by an unrestricted file upload mechanism within the plugin, which fails to validate file types during the upload process. An unauthenticated attacker can leverage this flaw to upload executable PHP scripts to the server, which can then be triggered to achieve full remote code execution.

The ability for an unauthenticated user to execute arbitrary code on the web server represents a total compromise of the application environment. This level of access enables attackers to exfiltrate sensitive database information, modify site content, or pivot into the underlying server infrastructure. Given the critical CVSS score of 9.8, this flaw necessitates immediate attention to prevent complete system takeover.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the Personal QR Message plugin from all WordPress installations until a security update is released by the vendor.

Proactive Monitoring: Review server access logs for any suspicious requests targeting the plugin directory or unexpected file uploads, particularly those involving .php extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads to the plugin directory and restrict access to executable files within non-privileged folders.

Public Exploit Available: No (exploit_available: unknown)

Due to the critical nature of this vulnerability and the absence of a vendor-supplied patch, the risk of total system compromise is extremely high. Administrators must prioritize the immediate removal of the affected plugin from their production environments to eliminate the attack surface entirely. Monitor vendor communications closely for the release of a security update before considering re-installation.