The Everest Toolkit WordPress plugin through version 1.2.3 does not validate file types during demo-content import because the WordPress file-type test is disabled. This allows users with high privileges (Administrator role by default, including non-super-admin site administrators on multisite installations) to upload executable PHP files to the uploads directory. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with administrator privileges can upload and execute arbitrary PHP code on the affected WordPress site, potentially leading to full site compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the system.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrator privileges to trusted users only and avoid using the demo-content import feature of the Everest Toolkit plugin. Monitor for updates from the vendor.