The Infility Global WordPress plugin suffers from an unrestricted file upload vulnerability (CWE-434) because its `upload_file` function validates only MIME types, which attackers can spoof, and the `import_data` function lacks capability checks. This allows authenticated users with low privileges (subscriber level and above) to upload arbitrary files to the server. Such arbitrary file upload vulnerabilities can lead to remote code execution if the uploaded files are executed by the server environment. The CVSS 3.1 score of 8.8 reflects the high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

An attacker with subscriber-level access or higher can upload arbitrary files to the affected WordPress site server. This could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions of the Infility Global plugin up to 2.14.42. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles that can upload files and monitor uploads closely. Avoid granting subscriber-level users unnecessary permissions. Review and harden file upload handling in the plugin or consider disabling the plugin if feasible.