The Limbcode WordPress Gallery Plugin – Limb Image Gallery contains an unrestricted file upload vulnerability that permits attackers with at least low privileges to upload files of dangerous types. This can lead to code injection, allowing attackers to execute arbitrary code on the affected system. The vulnerability affects all versions up to 1.5.7. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the server hosting the WordPress plugin, potentially leading to full system compromise. The CVSS score of 9.9 reflects high impact on confidentiality, integrity, and availability. This could result in data theft, site defacement, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the plugin if possible, or implement additional file upload validation controls to prevent dangerous file types from being uploaded.