The vulnerability arises because the plugin does not validate the file type when the accepted file types setting is left empty, which the documentation interprets as allowing all file types. This omission permits arbitrary files, including executable PHP scripts, to be uploaded by any user without authentication. When the server executes PHP from the uploads directory, an attacker can run malicious code with the privileges of the web server, resulting in full compromise of the affected system.

The issue affects WordPress sites that use the Checkout Files Upload for WooCommerce plugin versions prior to 2.4.0. The specific vendor is listed only as "Checkout Files Upload for WooCommerce," and no additional product variants are identified. Sites using any earlier version of the plugin are potential targets.

Because the upload interface is publicly accessible, the attack vector is an unauthenticated remote file upload. The absence of an EPSS score and the lack of listing in the CISA KEV catalog do not diminish the inherent severity; the ability to run arbitrary code on the server remains a critical risk. In practice, once a malicious PHP file is uploaded to the server’s upload directory, it can be accessed via a standard HTTP request, enabling remote code execution. The vulnerability is effectively exploitable with minimal effort once the upload feature is enabled.