The Pix for WooCommerce plugin for WordPress contains missing capability checks and file type validation in the lkn_pix_for_woocommerce_c6_save_settings routine, enabling an unauthenticated party to upload any file type. This flaw constitutes a single‑step arbitrary file upload that can allow an attacker to place a malicious script on the server, thereby enabling remote code execution. The weakness is identified as CWE‑434.

All WordPress sites that have installed the Pix for WooCommerce plugin from linknacional with a version of 1.5.0 or earlier are affected. No other build numbers beyond the 1.5.0 ceiling influence the risk; any release after 1.5.0 contains the fix.

The CVSS score of 9.8 places the vulnerability in the critical severity range, and the EPSS score of 30% indicates a relatively high likelihood of exploitation at this time. The issue is not listed in the CISA KEV catalog, so no widespread exploitation is documented. The likely attack vector is an unauthenticated HTTP request to the plugin’s settings handler; based on the description, it is inferred that an attacker can trigger the upload by sending such a request with a malicious payload that bypasses validation.