The PPOM – Product Addons & Custom Fields for WooCommerce plugin allows unauthenticated users to upload any file because the image cropper does not validate the file type. The absence of checks enables the upload of executable code, which could lead to remote code execution on the host web server. This vulnerability is classified as CWE‑434, indicating a failure to restrict file types or extensions during upload.

WordPress sites that use the PPOM plugin with versions 33.0.15 or earlier, and that have the paid edition active. The free edition contains the code but the flaw only manifests when the paid features are enabled. No other vendors or products are listed.

The CVSS score of 9.8 reflects the severity of this flaw, while the EPSS score of less than 1 % indicates that, at present, exploitation is unlikely but the impact would be catastrophic if it occurs. The vulnerability is not yet listed in the CISA KEV catalog, so no known exploit has been reported. Attackers would need to send a crafted HTTP request to the plugin’s image cropper endpoint; authentication is not required, so anyone on the public internet can attempt the upload.