The AI Power: Complete AI Pack WordPress plugin (renamed AI Puffer) suffers from an unrestricted file upload vulnerability (CWE-434) in the 'handle_image_upload' function. This vulnerability allows unauthenticated attackers to upload arbitrary files because the plugin fails to validate file types properly. The affected versions include all versions up to 1.8.89. Successful exploitation may enable remote code execution on the server hosting the WordPress site. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been published yet, and no known exploits are reported in the wild as of the publication date.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution on the affected WordPress server. This compromises the confidentiality, integrity, and availability of the system. The vulnerability is critical due to the ease of exploitation and the severe impact on the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the AI Power / AI Puffer plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.