This vulnerability in JoomUnited WP Media folder (up to version 5.7.2) allows an attacker with at least low privileges to upload files of dangerous types without restriction. This can lead to severe impacts including full system compromise. The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to upload malicious files that could lead to remote code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level. Since the plugin is used within WordPress environments, exploitation could compromise the entire web application and underlying server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious uploads. Consider disabling or removing the WP Media folder plugin if possible to reduce exposure.