The vulnerability CVE-2025-27282 affects the Theme File Duplicator plugin by rockgod100, allowing unrestricted upload of files with dangerous types. This means an attacker with low privileges can upload malicious files without any user interaction, which can lead to full system compromise. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected versions include all versions up to and including 1.3. No patch or remediation information is currently provided.

Successful exploitation can result in complete compromise of the affected system, including full loss of confidentiality, integrity, and availability. An attacker can upload and execute malicious files, potentially leading to remote code execution or other severe impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to trusted administrators only. Monitor for suspicious file uploads and consider disabling the plugin if possible.