This vulnerability (CWE-434) in Automattic Newspack Blocks permits an attacker with at least low privileges to upload files without proper restrictions on file types. This can enable uploading a web shell, resulting in remote code execution and complete system compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all versions up to 3.0.8. There is no vendor advisory or patch information currently available.

Successful exploitation allows an attacker to upload malicious files such as web shells to the web server, potentially leading to remote code execution, full system compromise, data theft, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions, implement strict file type validation, and monitor for suspicious uploads. Consider disabling file upload features if not essential.