The Vitepos – Point of Sale (POS) for WooCommerce plugin suffers from missing file type validation in the insert_media_attachment() function. The save_update_category_img() function accepts user‑supplied file types without verification, enabling authenticated users with subscriber level access or higher to upload arbitrary files. Because the uploaded files are stored on the server’s filesystem and are not validated, an attacker can place executable code and achieve remote code execution on the host. This flaw is a classic file‑upload vulnerability (CWE‑434).

Vitepos – Point of Sale (POS) for WooCommerce by appsbd. All plugin versions up to and including 3.3.0 are vulnerable. The issue appears in every WordPress instance that has Vitepos installed and any subscriber or higher role is permitted to add or edit product categories. The vulnerability does not affect earlier or newer releases beyond 3.3.0.

The CVSS score is 8.8, indicating a high severity. The EPSS score is less than 1%, suggesting exploitation is presently rare, and the vulnerability is not listed in CISA KEV. However, the required privilege is only a subscriber‑level account, which is common on many e‑commerce sites. If an attacker compromises a subscriber account or gains social‑engineering access, they can upload a malicious file, bypass server‑side validation, and execute code. The attack vector is through the insert_media_attachment() routine triggered during category image updates, so only authenticated users with the necessary role can exploit it.