The Uni CPO (Premium) plugin for WooCommerce does not properly validate uploaded file types in its 'uni_cpo_upload_file' routine, which allows an attacker to upload malicious files. If an uploaded file contains executable code, the attacker could achieve remote code execution on the server. This flaw is categorized as CWE-434 and scored 9.8 on CVSS, indicating a severe vulnerability.

The vulnerability affects MooMoo’s Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin, versions up to and including 4.9.55. Any WordPress site running an affected version is at risk.

With an EPSS score of less than 1 % the exploitation probability is low, but the lack of authentication makes the attack path simple; the attacker can upload files from any external source. The vulnerability is not currently listed in CISA’s KEV catalog, yet the high CVSS score signals critical importance. Protection against exploitation hinges on the ability to block or filter the upload endpoint and to keep the plugin patched when a fix becomes available.