WordPress Plugin Vulnerability Exposes 90,000 Sites to Attack

The flaw, discovered on January 6, allows attackers with contributor privileges or higher to upload malicious SVG files and execute remote code on vulnerable servers. The issue (CVE-2025-0366) has been given a CVSS score of 8.8 (High).