The CRM Perks Forms plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'handle_uploaded_files' function in versions up to and including 1.1.3. Authenticated attackers with administrator-level permissions can exploit this flaw to upload arbitrary files to the server, potentially leading to remote code execution. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor-provided patch or advisory at this time, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

Successful exploitation allows an attacker with administrator privileges to upload arbitrary files, which may lead to remote code execution on the affected server. This compromises confidentiality, integrity, and availability of the system running the vulnerable plugin. Because the attacker must have high privileges, the risk is limited to scenarios where such access is already obtained or possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor regarding an official fix.