The vulnerability in CreedAlly Bulk Featured Image plugin permits an authenticated user with high privileges to upload files without proper restriction on file types. This unrestricted file upload can be exploited to place a web shell on the server, enabling remote code execution and complete system compromise. The issue affects versions up to and including 1.2.4. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to upload a malicious web shell, leading to remote code execution on the web server. This results in full compromise of the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted administrators only and monitor for suspicious file uploads. Avoid exposing the upload functionality to untrusted users.