The Webinfos WordPress plugin through version 1.2 does not validate the type or name of uploaded files and lacks authentication, capability, or nonce checks on the upload action. This allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, to a web-accessible directory. Servers that execute PHP from the uploads path are vulnerable to remote code execution attacks due to this unrestricted file upload flaw.

Successful exploitation allows unauthenticated attackers to upload malicious files, including PHP scripts, which can be executed remotely. This leads to full compromise of the affected server, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload directory, disable PHP execution in the uploads path, or remove the vulnerable plugin to mitigate risk.