The StoreEngine eCommerce plugin for WordPress suffers from a lack of file type validation in the import() function. This flaw allows authenticated users with at least Subscriber-level access to upload any file, which can lead to remote code execution if attackers place executable or script files in a web‑accessible directory. This weakness is a CWE‑434 Unvalidated File Type or Extension.

WordPress sites running the StoreEngine plugin from kodezen, any released version up to and including 1.5.0.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% points to a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers need only valid subscriber credentials and can trigger the vulnerable import() routine to place arbitrary files on the server, potentially enabling remote code execution.