Summary
WP Easy Pay 4.2.11 exposes a WordPress AJAX file-upload handler that accepts uploads without requiring an authenticated session or equivalent authorization check. In a local lab instance, an unauthenticated caller could place a file under the site uploads directory and receive a public URL to the stored object. Public advisory text intentionally omits request parameters and proof-of-concept material.
Impact
Unauthenticated arbitrary file upload can lead to stored malicious content on the server, potential remote code execution when executable content is reachable, website defacement, and further compromise of the WordPress installation and its data.
Remediation
Require authentication and an appropriate capability before accepting uploads. Validate file type, size and extension server-side, store uploads outside the web root when possible, and reject unauthenticated AJAX actions that write files.
Why no CVE
No public CVE identifier has been assigned yet. Recorded after local verification; proof-of-concept requests are excluded from the public site.