An arbitrary file upload vulnerability in the UltimateAI plugin allows authenticated subscribers to execute arbitrary code on the server, presenting a critical security risk.

This is an unrestricted upload of file with dangerous type (CWE-434). The vulnerability allows a user with subscriber-level privileges to upload files that may facilitate remote code execution on the hosting environment.

An attacker with basic subscriber access can leverage this flaw to gain full control over the web server. With a CVSS score of 9.9, the impact includes total system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: Update the UltimateAI plugin to the latest version. If a patch is not available, deactivate the plugin until a secure version is released.

Proactive Monitoring: Review file system changes and audit logs for unauthorized file creation, particularly in directories where uploads are permitted.

Compensating Controls: Restrict file upload capabilities at the server or WAF level to block executable file extensions like .php, .php5, or .phtml.

Public Exploit Available: No

This vulnerability represents a critical risk due to the potential for remote code execution. Security teams should ensure that all instances of UltimateAI are patched immediately and review user account permissions to minimize the threat of malicious actors utilizing subscriber accounts.