The Echo RSS Feed Post Generator plugin for WordPress contains an unrestricted file upload vulnerability (CWE-434) due to lack of file type validation in the echo_generate_featured_image() function in all versions up to 5.4.8.1. This flaw permits unauthenticated attackers to upload arbitrary files to the server hosting the plugin, potentially enabling remote code execution. The vulnerability is publicly documented as CVE-2025-4391 with a critical CVSS 3.1 base score of 9.8, reflecting its ease of exploitation and severe impact. The plugin is not a cloud service, and no patch or official remediation has been provided in the available data.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, which may lead to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin. The critical CVSS score (9.8) reflects the high severity and potential for complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's upload functionality if possible, and monitor for suspicious file uploads. Avoid using the affected plugin versions and consider disabling or removing the plugin temporarily to mitigate risk.