The ValvePress WordPress Automatic Plugin suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. Specifically, the plugin fails to properly validate file types in the 'core.php' file, allowing authenticated users with Author-level access or above to upload arbitrary files. This can lead to remote code execution if malicious files are uploaded and executed on the server. The vulnerability affects all versions up to and including 3.115.0. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and privileges required at the Author level. No patch or official fix has been disclosed at this time.

An attacker with Author-level or higher privileges on a WordPress site using the vulnerable plugin can upload arbitrary files to the server. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability poses a significant risk to site security and data protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user permissions to trusted users only and monitor plugin updates from ValvePress. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if not essential.