The vulnerability arises from insufficient input validation and type checking on the wpuf_files parameter combined with unconditional deserialization using maybe_unserialize() when displaying post content. Authenticated attackers with low privileges can exploit this to inject crafted PHP objects, potentially leading to remote code execution or other severe impacts if the environment supports a gadget chain for exploitation. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in arbitrary code execution, deletion of arbitrary files, and other malicious actions, severely compromising the affected WordPress site. The vulnerability affects confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access if possible and monitor for suspicious activity related to form submissions involving the wpuf_files parameter. Avoid using the affected plugin version in high-risk environments.