The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
WordPress
File Upload
Bug Library
Bug Library Project
NVD
WPScan
CVSS 3.1
9.1
EPSS
0.8%