The File Uploader for WooCommerce plugin for WordPress contains a flaw where the 'add-image-data' REST API endpoint does not perform file type validation. An attacker can submit any file through this endpoint, causing the plugin to upload the file to the external Uploadcare service. Because the plugin subsequently retrieves the uploaded file from the site’s server, the attacker can place a malicious script on the server and potentially execute it. This vulnerability enables remote code execution when the attacker controls the content of the uploaded file.

Snowray’s File Uploader for WooCommerce plugin is affected for all releases up to and including version 1.0.3. WordPress sites running any of these versions are at risk.

The CVSS v3.1 score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests a low probability of being exploited in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is through unauthenticated HTTP requests to the WooCommerce REST API endpoint, where the attacker supplies arbitrary file data.