The vulnerability allows an attacker to upload files of any type to the web server. Because the plugin does not validate the file content, a malicious user could upload a web shell or other executable code and execute it. This leads to remote code execution on the affected site, enabling full compromise of the underlying server.

The flaw exists in Printcart Web to Print Product Designer for WooCommerce, affecting all releases up to and including 2.3.9. Any WordPress site that has this plugin installed and not upgraded with a later version is vulnerable. The plugin is used by WooCommerce merchants and other e‑commerce customers.

The CVSS score of 10 indicates maximum severity. The EPSS score of <1% shows that exploitation attempts are currently rare, but the lack of any restrictions in the upload path suggests that attackers could target the plugin from any user session, possibly even unauthenticated, once a staging/guest upload point is found. The vulnerability is not yet listed in CISA KEV, but should be treated as high‑risk due to potential RCE.