The WP donimedia carousel plugin versions up to 1.0.1 suffer from an unrestricted file upload vulnerability that permits an authenticated user with low privileges to upload files of dangerous types, such as web shells. This can result in remote code execution and full compromise of the affected web server. The vulnerability is publicly disclosed with a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No vendor advisory or patch links are currently available, and the plugin is not a cloud service.

Successful exploitation allows an attacker with low privileges to upload malicious files (e.g., web shells) to the server hosting the vulnerable plugin. This can lead to complete compromise of the web server, including unauthorized access, data theft, data modification, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the WP donimedia carousel plugin to prevent exploitation.