This vulnerability permits unrestricted upload of files with dangerous types in the AI Postpix plugin, enabling an attacker with low privileges to upload a web shell to the web server. The affected versions are from initial releases through 1.1.8. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an attacker with low privileges to upload arbitrary files, including web shells, leading to full system compromise. This includes complete loss of confidentiality, integrity, and availability of the affected server hosting the AI Postpix plugin. The vulnerability is rated critical with a CVSS score of 9.9. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict file upload permissions and monitor for suspicious uploads if possible. Avoid exposing the vulnerable plugin in untrusted environments. No official fix or temporary workaround has been published by the vendor as of now.