This vulnerability allows an unauthenticated attacker to upload arbitrary files through the WordPress & WooCommerce Scraper Plugin, Import Data from Any Site. The upload mechanism does not properly validate or restrict file types, enabling the placement of malicious scripts on the server. If the uploaded file is interpreted by the web application, an attacker could gain write access, execute code, or compromise the entire WordPress installation. The weakness is categorized as CWE‑434, indicating improper restriction of file upload/input validation.

Any WordPress site running Extendons’ WordPress & WooCommerce Scraper Plugin, Import Data from Any Site version 1.0.7 or earlier is affected. The vulnerability is active until the plugin is upgraded beyond 1.0.7.

The CVSS score of 10 denotes critical severity, and the lack of an EPSS score means the current exploitation likelihood is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it via unauthenticated web requests to the plugin’s upload endpoint, requiring no special permissions. Once a file is uploaded, execution of that file can lead to complete compromise of the hosting environment.