A critical arbitrary file upload vulnerability in the EDGE22 Studios GP Premium WordPress plugin could allow authenticated attackers to achieve remote code execution.

This vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434), which enables an attacker with Contributor-level privileges to bypass security controls and upload malicious scripts to the server.

Successful exploitation allows an attacker to execute arbitrary code on the underlying web server, leading to a complete compromise of the WordPress installation. Given the CVSS score of 9.9, this vulnerability poses a severe risk to data confidentiality, integrity, and system availability, potentially facilitating further lateral movement within the network.

Immediate Action: Update the GP Premium plugin to version 2.5.6 or later immediately to resolve the unrestricted file upload flaw.

Proactive Monitoring: Review web server access logs for requests targeting file upload directories from accounts with Contributor privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file extensions or unauthorized upload requests to the plugin directory.

Public Exploit Available: Unknown

The high CVSS score reflects the potential for total system compromise. Administrators must prioritize updating the GP Premium plugin to version 2.5.6 or higher to eliminate this attack vector.