The nunomorgadinho Plugin Propagator WordPress plugin version 0.1 and earlier contains an unrestricted file upload vulnerability that allows attackers to upload files with dangerous types, such as web shells, to the web server. This vulnerability can be exploited remotely without any privileges or user interaction, resulting in full system compromise. The CVSS v3.1 base score is 10.0 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. No patch or mitigation details have been provided by the vendor or third parties as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files, including web shells, leading to complete compromise of the affected web server. This includes full confidentiality, integrity, and availability loss of the system hosting the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor official sources for updates and apply patches as soon as they are released.