This vulnerability allows an attacker to upload any file, including web shells, to the server without restriction. By doing so, the attacker can execute arbitrary code on the web server, potentially gaining full control of the WordPress site and its underlying infrastructure. The weakness is a classic unrestricted file upload flaw, identified as CWE-434, which directly compromises confidentiality, integrity, and availability of the affected site.

StoreKeeper B.V.'s StoreKeeper for WooCommerce plugin is vulnerable in all versions up to and including 14.4.4. The vulnerability applies from the earliest release through the specified upper bound, meaning any site running a version 14.4.4 or older is at risk.

The vulnerability carries a CVSS score of 10, reflecting a very high severity. The EPSS score of less than 1% indicates that active exploitation is currently unlikely, but the potential impact remains extreme. The attack is likely to occur via the web upload interface, requiring only web access to the plugin’s upload endpoint. Because the vulnerability is not listed in the CISA KEV catalog, no public exploits are known, yet the sheer ease of uploading a web shell warrants urgent mitigation.