CVE-2025-10041 is a critical vulnerability in the ajitdas Flex QR Code Generator WordPress plugin, affecting all versions up to 1.2.5. The issue arises from the lack of file type validation in the save_qr_code_to_db() function, which allows unauthenticated attackers to upload arbitrary files to the server. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact and network attack vector with no required privileges or user interaction.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the Flex QR Code Generator plugin to prevent exploitation.