A high-severity vulnerability in the Squeeze plugin allows authenticated users with the upload_files capability to achieve remote code execution by uploading malicious PHP files.

This is an unrestricted file upload vulnerability resulting from a failure to validate file extensions during attachment updates. The flaw requires the attacker to hold the upload_files capability, typically held by users with an Author role or higher.

The CVSS score of 8.8 highlights the high risk posed by this vulnerability, as it allows an authenticated user to escalate their privileges to full server-side code execution. This can lead to total system compromise, unauthorized data access, and the potential for lateral movement within the hosting network.

Immediate Action: Update the Squeeze plugin to version 1.7.12 or later immediately.

Proactive Monitoring: Regularly scan the WordPress uploads directory for suspicious executable files, such as PHP scripts, that should not be present in a media library.

Compensating Controls: Enforce strict file upload policies and restrict the upload_files capability to the minimum number of trusted users necessary for business operations.

Public Exploit Available: No confirmed public exploit is available in the provided data.

While this vulnerability requires authenticated access, the impact of successful remote code execution is severe. Organizations should ensure all installations are updated to version 1.7.12 and review user roles to ensure that the upload_files capability is assigned only to authorized personnel.