The vulnerability CVE-2025-58819 affects the Bulk Featured Image plugin by CreedAlly, allowing unrestricted upload of files with dangerous types. This flaw permits an attacker with high privileges to upload a web shell, which could be used to execute arbitrary code on the server. The CVSS 3.1 base score is 9.1, reflecting critical impact with network attack vector, low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability. The affected versions include all versions up to 1.2.4. No vendor patch or advisory is currently referenced.

Successful exploitation allows an attacker with high privileges to upload a web shell to the server, leading to full system compromise including data theft, modification, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's upload functionality to trusted users only and monitor for suspicious file uploads. Consider disabling or removing the plugin if not essential.