This vulnerability in WebFactory AiBud WP (up to version 1.9) permits an attacker with high privileges to upload files of dangerous types without restriction, including web shells, which can be executed on the server. The CVSS 3.1 score of 9.1 reflects network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue is publicly disclosed but no official patch or fix has been referenced in the available data.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server, potentially leading to full system compromise, data theft, and service disruption. The vulnerability affects all installations of AiBud WP version 1.9 and earlier. There are no known active exploits reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted administrators only and consider disabling file upload functionality if possible. Monitor for updates from WebFactory regarding patches or mitigations.