A critical vulnerability in the AF Companion WordPress plugin allows authenticated attackers to execute arbitrary code on the host server.

This flaw is an improper control of generation of code (CWE-94) where the plugin fails to sanitize or validate file uploads in its import feature, permitting an authenticated user with store-management privileges to upload malicious PHP files.

The ability to perform remote code execution poses a catastrophic risk to organizational security, as it grants an attacker full control over the affected web server. Given the CVSS score of 9.1, this vulnerability can lead to complete data exfiltration, total system compromise, and significant reputational damage if the server is used as a pivot point for further network attacks.

Immediate Action: Update the AF Companion plugin to version 2.2.0 or later immediately to implement the required file validation logic.

Proactive Monitoring: Review web server access logs for suspicious file upload requests, particularly those targeting the plugin's import functionality, and monitor for unexpected PHP process execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing executable extensions such as .php, .phtml, or .php7, particularly from unauthorized or low-privileged accounts.

Public Exploit Available: Unknown

Organizations utilizing the AF Companion plugin must prioritize this update as part of their standard patch management cycle. Because the vulnerability allows for total system takeover via malicious file uploads, failure to remediate could result in a full site compromise. Verify all plugin installations and ensure the latest version is running across all production environments.