The Zegen Core plugin for WordPress up to version 2.0.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows unauthenticated attackers to upload arbitrary files. This vulnerability arises from missing nonce and file type validation in a specific PHP file, enabling attackers to potentially achieve remote code execution by tricking an administrator into performing an action.