Unrestricted file upload in the WooCommerce Designer Pro plugin allows an attacker to upload a web shell onto the server. This flaw can give the attacker the ability to execute arbitrary code on the site, compromising confidentiality, integrity, and availability of the web application.

The vulnerability exists in WooCommerce Designer Pro from the initial release through version 1.9.24, available from HaruTheme. All installations that have not upgraded beyond 1.9.24 are vulnerable.

The CVSS v3 score of 10 indicates full impact if exploited. EPSS indicates a very small but non-zero probability of exploitation, and the vulnerability is not listed as a known exploited vulnerability in KEV. The likely attack vector is through the plugin’s file upload interface, presumably accessible to users with sufficient permissions. Based on the description, it is inferred that the plugin does not properly validate MIME types or file paths, permitting direct placement of executable scripts.