The Drag and Drop Multiple File Upload for WooCommerce plugin permits an attacker to specify arbitrary file paths through the wc-upload-file[] parameter. This lack of validation allows the moving of any file on the server, including critical WordPress configuration files. Once a sensitive file such as wp‑config.php is relocated or replaced, the attacker can achieve full remote code execution on the WordPress site.

WordPress sites running the Drag and Drop Multiple File Upload for WooCommerce plugin, versions up to and including 1.1.4, left unpatched. Any installation of the plugin in these versions is vulnerable regardless of the site’s user roles or authentication state.

The CVSS score of 9.8 reflects a critical severity, and the EPSS score of 3% indicates that exploitation is moderately likely in the wild. The vulnerability is not listed in CISA’s KEV catalog, but the high risk and the potential for remote code execution mean that attackers can freely move files when the wc-upload-file[] parameter is accessible. Based on the description, the attack likely requires sending a specially crafted HTTP request to the plugin’s file upload endpoint, which is publicly reachable on typical WooCommerce installations.