WooCommerce Designer Pro implements an AJAX endpoint, wcdp_save_canvas_design_ajax, that accepts file uploads with no validation of file type. An unauthenticated attacker can therefore upload any file to the site’s server, and if a malicious script is uploaded the attacker may achieve arbitrary code execution on the server. The weakness is identified as CWE‑434 and can compromise the confidentiality, integrity, and availability of the website.

WordPress sites that have the WooCommerce Designer Pro plugin from JMA Plugins installed at version 1.9.26 or older. The plugin is commonly used with the Pricom – Printing Company & Design Services WordPress theme, so any site using that theme with a vulnerable version of the plugin is affected.

The vulnerability has a CVSS score of 9.8, indicating very high impact, while the EPSS score is less than 1 %, suggesting a low overall probability of exploitation at present. It is not listed in CISA’s KEV catalog. Attackers only need unauthenticated access to the endpoint to upload a file; no further credentials or privileged actions are required. If code execution is achieved, the attacker can maintain persistent control or exfiltrate data.