The WP Chill Filr plugin version 1.2.14 and earlier suffers from an unrestricted file upload vulnerability that permits an attacker with low privileges to upload files of dangerous types, such as web shells, to the web server. This vulnerability can be exploited remotely without user interaction and impacts the confidentiality and integrity of the system. The CVSS v3.1 base score is 8.1, reflecting high severity with network attack vector, low attack complexity, no user interaction, and partial privileges required.

Successful exploitation allows an attacker to upload a web shell, which can lead to unauthorized access and control over the web server, compromising confidentiality and integrity. Availability impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious uploads. Avoid granting unnecessary privileges to users who can upload files.