The WP Remote Thumbnail plugin suffers from an unrestricted file upload vulnerability that permits attackers with low privileges to upload malicious files, such as web shells, to the web server. This vulnerability affects all versions up to 1.3.2. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact includes full compromise of confidentiality, integrity, and availability of the affected system. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to upload arbitrary files, including web shells, leading to full system compromise. This includes unauthorized access to sensitive data, modification or deletion of data, and disruption of service. The vulnerability requires only low privileges and no user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, disable the vulnerable plugin if possible, and monitor for suspicious activity related to file uploads.