This vulnerability in the vcita Online Booking & Scheduling Calendar for WordPress allows an attacker with high privileges to upload files of dangerous types without restriction. Such unrestricted file upload can enable execution of malicious code or other harmful actions. The affected versions are from initial releases through 4.5.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could result in full compromise of the affected WordPress site, including unauthorized code execution, data theft, data modification, or denial of service. The critical CVSS score reflects the potential for severe impact on the system's security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to reduce risk. Monitor for updates from vcita regarding patches or mitigations.