The Pix for WooCommerce plugin for WordPress allows unauthenticated users to upload arbitrary files because the lkn_pix_for_woocommerce_c6_save_settings function lacks a capability check and file type validation. This flaw is a single-step vulnerability that can lead to remote code execution if an attacker uploads a malicious script to the server. The weakness is identified as CWE-434.

All installations of the Pix for WooCommerce plugin from linknacional with version 1.5.0 or earlier are affected. No specific build numbers are listed beyond the upper bound of 1.5.0.

The vulnerability has a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Attackers can exploit the flaw by sending an unauthenticated request to the affected plugin’s settings handler, uploading a malicious file that is then accessible to the web server.