This vulnerability, identified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affects wpWax Templatiq versions up to 0.2.5. It allows users with contributor-level privileges to upload arbitrary files without proper validation or restriction on file types. Such a flaw can be exploited to upload malicious scripts or executables, potentially leading to full system compromise. The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and complete impact on confidentiality, integrity, and availability. As of the publication date, no official fix or patch has been disclosed by the vendor.

Successful exploitation allows an attacker with contributor privileges to upload and execute arbitrary files, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This can lead to unauthorized data access, modification, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges and monitor file upload functionality closely to prevent exploitation.