The Gpx2Graphics WordPress plugin contains a critical file upload vulnerability that allows attackers to achieve remote code execution via a cross-site request forgery attack.

The plugin fails to perform CSRF checks and file validation during upload processes, allowing an attacker to trick a logged-in administrator into uploading malicious files, such as PHP scripts.

The ability to upload and execute arbitrary files on a server presents a severe risk of total system compromise, data theft, and unauthorized access. With a CVSS score of 7.2, this vulnerability is classified as high severity, reflecting the potential for full administrative takeover of the affected WordPress instance.

Immediate Action: Since no patch is currently available, administrators should immediately deactivate and remove the Gpx2Graphics plugin from their WordPress environments.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or unauthorized attempts to access newly created PHP files in the media or plugin directories.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious file extensions or non-standard upload patterns directed at the plugin endpoint.

Public Exploit Available: No

Given the lack of an available patch, the risk of remote code execution cannot be mitigated through standard updates. Security teams must prioritize the immediate removal of the vulnerable plugin to prevent unauthorized access and potential persistent compromise of the hosting infrastructure.