The WP-Advanced-Search plugin for WordPress contains an unrestricted file upload vulnerability allowing attackers with high privileges to upload files of dangerous types, such as web shells, to the web server. This can lead to partial compromise of the system's confidentiality, integrity, and availability. The vulnerability affects all versions up to 3.3.9.4. No known exploits in the wild have been reported, and no patch or official fix information is currently available.

Successful exploitation allows an attacker with high privileges to upload malicious files, such as web shells, potentially enabling remote code execution or unauthorized control over the web server. This impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. However, exploitation requires high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious uploads. Limit access to the plugin to trusted administrators only.