The WP STAGING plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the wpstg_processing AJAX action. Authenticated attackers with administrator-level access can exploit this by uploading arbitrary files without proper validation of file types. This can enable remote code execution on the server hosting the WordPress site. The vulnerability affects all versions up to and including 3.4.3 and has a CVSS 3.1 score of 9.1, reflecting critical severity with network attack vector, low attack complexity, and high privileges required.

Successful exploitation allows an authenticated administrator to upload arbitrary files, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the vulnerable plugin. Monitor vendor channels for updates and apply any official patches promptly once available.