The Easy Upload Files During Checkout plugin fails to verify the MIME type of files uploaded in the checkout process. This omission allows an unauthenticated user to submit any JavaScript file, which the server accepts and stores. Once in place, that file can be served and executed by the application, giving the attacker control of the site’s execution context. The flaw is identified as CWE‑434, file upload through insecure type validation.

WordPress sites that have the Easy Upload Files During Checkout plugin by fahadmahmood installed, in any version up to and including 2.9.8, are affected. The vulnerability applies to every instance of the plugin regardless of theme or other plugin configuration.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests that current exploitation activity is low, and the flaw is not yet listed in CISA’s KEV catalog, indicating no widely reported attacks. However, because the upload endpoint is publicly reachable and does not enforce authentication, any visitor can trigger the upload path, making the vulnerability readily exploitable in the absence of other mitigations.