The Aeropage Sync for Airtable WordPress plugin suffers from CWE-434: Unrestricted Upload of File with Dangerous Type due to lack of file type validation in the 'aeropage_media_downloader' function. Authenticated attackers with low privileges (Subscriber-level and above) can upload arbitrary files to the server, which may enable remote code execution. This vulnerability affects all versions up to and including 3.2.0. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Successful exploitation allows authenticated users with minimal privileges to upload arbitrary files, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its hosting server. Given the low privilege required and network accessibility, the impact is significant for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor user roles to prevent Subscriber-level or higher users from uploading files via this plugin. Consider disabling or removing the Aeropage Sync for Airtable plugin if file upload functionality is not required or if risk is unacceptable.