The vulnerability CVE-2025-53260 in the getredhawkstudio File Manager Plugin for WordPress allows an authenticated user with high privileges to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting an attacker remote code execution capabilities on the affected web server. The issue affects versions up to 7.5 of the plugin. The CVSS 3.1 score is 9.1 (critical), indicating high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker with high privileges to upload arbitrary files, including web shells, leading to full compromise of the web server. This can result in unauthorized access, data theft, modification, or destruction, and disruption of service. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted administrators only and monitor for suspicious file uploads. Consider disabling or removing the plugin if not essential. Avoid exposing the WordPress admin interface to untrusted networks.