This vulnerability (CWE-434) in Sync Post With Other Site plugin versions up to 1.9.3 allows users with contributor privileges to upload files of dangerous types without restriction. This arbitrary file upload flaw can be exploited remotely over the network without user interaction, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, limited privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

Successful exploitation allows an attacker with contributor-level access to upload arbitrary files, potentially leading to full system compromise including data theft, modification, or destruction, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level user permissions and monitor for suspicious file uploads. Avoid granting contributor privileges to untrusted users.