The Extra Checkout Options plugin for WordPress allows arbitrary file uploads due to missing authorization and nonce validation in the eco_save_settings() function. This flaw lets a low‑privileged authenticated user modify the tc_eco_custom_file_types allowlist and exploit the wc_eco_upload_file AJAX action. An attacker with Subscriber‑level access can upload PHP files through the frontend on cart and checkout pages, achieving remote code execution. The underlying weakness is CWE‑434, where an application permits file uploads of dangerous types without proper restriction.

WordPress sites that use the ThemeComplete Extra Checkout Options add‑on for the Extra Product Options plugin. Vulnerable versions are 2.3.2 and earlier. Site owners using this plugin for WooCommerce should verify the "Eco Checkout Options" installation version and consider any subsequent release that removes the upload path or restricts file types.

The CVSS score of 8.8 marks a high‑severity vulnerability. The EPSS score of less than 1% indicates a low current exploitation probability, and it is not listed in the CISA KEV catalog. The attack vector is web‑based; an authenticated user can drive the process by interacting with the exposed nonce and AJAX endpoint, so the threat is real even in the absence of publicly known exploits.