This vulnerability exists because the plugin accepts per-size image data through an attachment-update action — a context where developers think about image processing, not file validation. WordPress validates files at the upload entry point, but per-size metadata written through this separate channel bypasses that validation entirely. The result: any authenticated user with upload_files capability (Author role and above) can achieve remote code execution by writing a PHP file through the per-size data parameter.
What makes this exploitable is the blast radius, not the complexity. There's no multi-step attack chain — you send a crafted per-size payload that writes a .php file to an accessible directory, then request it. The plugin's entire value proposition is generating image variants, so the write path is legitimate functionality; the failure is that the security boundary was drawn around the original upload rather than around every data surface that terminates in filesystem writes.
For defenders: audit any plugin that processes attachment metadata and writes to disk. Check whether per-size, thumbnail, or variant generation paths have their own file type validation — don't assume the upload validation covers it. The fix likely adds explicit wp_check_filetype() or equivalent checks at each write point, but that treats the symptom. The architectural question is whether your plugin creates indirect data paths that terminate at privileged operations without going through the same validation gates as direct uploads. If it does, you've built a second upload channel by accident.
This follows the recurring pattern where structured data formats describing content get treated as inert metadata. XXE, EXIF execution, PDF metadata code execution — all share the same cognitive trap: data that signals 'description' gets exempted from 'content' validation. The plugin developer wasn't negligent; they were working in the image-processing mental context where per-size data feels like configuration, not input. That's the exact boundary where security blind spots form.