The vulnerability CVE-2025-53251 in An-Themes Pin WP plugin allows an attacker with low privileges to upload files of dangerous types without restriction. This can include web shells, which enable remote code execution on the web server. The issue affects all versions prior to 7.2. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No known exploits are reported in the wild as of the publication date.

Successful exploitation allows an attacker to upload arbitrary files, including web shells, leading to full compromise of the web server. This impacts confidentiality, integrity, and availability of the affected system, potentially allowing remote code execution and persistent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious uploads. Consider disabling the vulnerable plugin or restricting its usage to trusted users only.