The Funnelforms Free plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'af2_add_font' function, present in all versions up to 3.7.3.2. Authenticated attackers with administrator or higher privileges can upload arbitrary files without proper file type validation, potentially leading to remote code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level access can upload arbitrary files to the server hosting the vulnerable WordPress plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability does not allow unauthenticated exploitation and requires high privileges, limiting the attack surface to trusted users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious file uploads related to the 'af2_add_font' function. Avoid using the affected plugin version in sensitive environments if possible.