WooCommerce 7.1.0 exposes a remote code execution flaw through the class-wc-meta-box-product-images.php endpoint. The vulnerability arises because an attacker can supply unsanitized values for the product-type parameter, allowing arbitrary PHP code to be written to the web root. This leads to full control over the affected WordPress site, enabling attackers to steal data, deface, or install malware. The weakness is a classic injection scenario identified as CWE‑94.

The flaw affects the WooCommerce plugin for WordPress, specifically version 7.1.0. WordPress sites running this version are vulnerable unless mitigated by a patch or configuration change. No other product or vendor variations are listed in the CNA data.

The CVSS score of 9.3 indicates critical severity, and because attackers can trigger the vulnerability via a crafted HTTP request, the likelihood of exploitation is high in environments where the endpoint is publicly exposed. EPSS data is not available, but the lack of a KEV listing does not diminish the risk, as the flaw allows remote code execution. An attacker can simply send a request with a malicious product-type value to write a PHP shell, gaining immediate control over the server.