The WP Load Gallery plugin (version <= 2.1.6) suffers from an unrestricted file upload vulnerability that permits users with high privileges to upload files with dangerous types, such as web shells, to the web server. This vulnerability can be exploited to achieve full system compromise, impacting confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2025-23942 and has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No patch or official fix has been documented in the provided data.

Successful exploitation allows an attacker with high privileges to upload malicious files, including web shells, to the server hosting the WP Load Gallery plugin. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is critical due to the potential for full system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to the WP Load Gallery plugin and consider disabling or removing the plugin if not essential. Monitor for suspicious file uploads and unauthorized changes on the server.