The vulnerability identified as CVE-2026-28133 affects the WP Chill Filr plugin for WordPress, specifically versions up to and including 1.2.14. It allows an attacker with low privileges to upload files of dangerous types without proper restrictions or validation. This can result in the attacker uploading a web shell, which may be used to execute arbitrary code on the server. The CVSS v3.1 base score is 8.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation of this vulnerability can lead to complete compromise of the affected web server, including unauthorized code execution, data theft, data modification, and service disruption. The attacker can upload a web shell, which provides persistent remote access and control over the server environment.

Patch status is not yet confirmed — no official patch or vendor advisory is provided in the available data. Users of WP Chill Filr plugin should monitor the vendor's official channels for updates and advisories. Until a patch is available, restrict file upload permissions and consider disabling the plugin if feasible to reduce exposure.