The Piotnet Forms plugin for WordPress suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability exists in the 'piotnetforms_ajax_form_builder' function where file type validation relies on an incomplete blacklist that blocks only a few extensions (php, phpt, php5, php7, exe) but permits other dangerous extensions such as .phar and .phtml. This flaw enables unauthenticated attackers to upload arbitrary files to the server hosting the affected WordPress site, potentially leading to remote code execution. Exploitation requires that the targeted form includes a file upload field. The vulnerability affects all versions up to and including 2.1.40. No official fix or patch has been documented as of the published date.

Successful exploitation allows unauthenticated attackers to upload arbitrary files with dangerous extensions to the web server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects critical severity with network attack vector, no privileges required, no user interaction, and impacts on all security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider removing or disabling file upload fields in Piotnet Forms or restricting access to forms that include file uploads. Monitoring for suspicious file uploads and applying web application firewall rules to block dangerous file types may provide temporary mitigation. Avoid relying solely on the plugin's built-in file type restrictions.