The vulnerability arises from a capability check flaw in the save_ajax() licensing function and unrestricted file extraction in sync_cloud_protection(). An attacker with at least Subscriber privileges can inject a malicious cloud_protection_url into the license metadata. The plugin downloads and extracts files from this URL without validating file types, placing potentially dangerous files into a web-accessible uploads directory. Exploitation requires allow_url_fopen to be enabled in PHP. This vulnerability is tracked as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution on the affected server, compromising confidentiality, integrity, and availability of the WordPress site. Attackers can upload and execute arbitrary PHP code, potentially leading to full system compromise. The vulnerability requires authenticated access at Subscriber level or higher and PHP configuration that permits remote file access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and consider disabling allow_url_fopen in PHP configuration to mitigate remote file download exploitation. Monitor vendor channels for updates and apply patches promptly once released.