The vulnerability permits an attacker to upload files of any type through the StoreKeeper for WooCommerce plugin. This unrestricted file upload can be used to place malicious code on the server, leading to compromise of the website’s confidentiality, integrity, and availability. The weakness corresponds to CWE‑434, a classic file upload flaw that can easily evolve into remote code execution if the uploaded payload is executable.

The affected entity is StoreKeeper B.V.’s StoreKeeper for WooCommerce plugin. All releases from the start of support up through version 14.4.4 are vulnerable; any installation of a version <= 14.4.4 is at risk.

The CVSS score of 10.0 marks this as a critical issue. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation in the wild, and the vulnerability has not yet appeared in the CISA KEV catalog. Based on the description, the likely attack vector is exploitation of the plugin’s upload interface, which may be reachable by authenticated administrators or possibly by unauthenticated users if the upload endpoint is publicly exposed.