A critical vulnerability in the WP images upload on piclect WordPress plugin allows unauthenticated attackers to execute arbitrary code on the host server.

The plugin suffers from an Unrestricted Upload of File with Dangerous Type (CWE-434) flaw, where the lack of server-side validation permits an unauthenticated attacker to upload malicious files directly to a publicly accessible directory.

The ability for an unauthenticated attacker to execute arbitrary code provides full control over the web server. This poses an extreme risk of data exfiltration, total system compromise, and potential lateral movement into the internal network. Given the CVSS score of 9.8, this vulnerability represents a critical threat to organizational integrity and should be addressed with the highest priority.

Immediate Action: As no patch is currently available, immediately deactivate and remove the WP images upload on piclect plugin from all WordPress environments.

Proactive Monitoring: Review web server access logs for requests to suspicious file extensions or unexpected file creation events in the uploads directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to the uploads directory to prevent direct execution of scripts.

Public Exploit Available: No (exploit_available: false).

Due to the critical nature of this vulnerability and the current lack of a vendor-supplied patch, the risk of continued use is unacceptable. Administrators must identify all instances of the affected plugin and remove them from the environment immediately to prevent unauthorized code execution.