An unrestricted upload of files with dangerous types is possible in templateinvaders TI WooCommerce Wishlist. The flaw allows an attacker to place a web shell on the server, providing the ability to execute arbitrary code. The lack of proper file type validation directly enables this malicious payload without user interaction beyond the upload action. The compromise grants complete control over the affected system and can lead to data theft, defacement or further infections.

WordPress installations that have the TI WooCommerce Wishlist plugin version 2.9.2 or earlier are affected. Administrators and site owners need to verify whether their WordPress sites use this plugin and determine the exact version used.

The CVSS score of 10 indicates a critical severity. The EPSS score of 33% indicates that exploitation is more probable, yet the vulnerability remains in the wild and can be leveraged by attackers with access to the plugin’s upload functionality. It is not listed in the CISA KEV catalog. Based on the description, the expected attack vector is via the plugin’s file upload endpoint, which accepts arbitrary file types without validation. The vulnerability is likely exploitable by any user who can submit a file through the upload form, implying a broad attack surface with minimal prerequisites beyond the ability to interact with the upload interface.