This vulnerability (CWE-434) in the Chauffeur Taxi Booking System for WordPress permits attackers to upload files of dangerous types without restriction. The issue affects all versions up to 7.2 and has a CVSS 3.1 base score of 10.0, indicating critical risk with network attack vector, no required privileges or user interaction, and impacts on confidentiality, integrity, and availability. No official fix or patch has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to upload malicious files, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable file upload functionality in the plugin if possible, and apply strict file type validation at the web server or application firewall level to prevent dangerous file uploads.