The Media.net Ads Manager plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'sendMail' function. This vulnerability arises from missing file type validation and missing capability checks, allowing authenticated users with subscriber-level permissions or higher to upload arbitrary files to the server. The attack vector requires prior API login activity on the site. Successful exploitation may enable remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 2.10.13. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

An attacker with subscriber-level or higher permissions can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability requires prior API login activity, limiting exposure to sites where API logins have occurred. The CVSS score of 8.8 reflects high impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions and monitor API login activity to reduce exposure. Consider disabling or restricting API access if not required. Avoid installing or using affected versions of the plugin where possible.