The flaw stems from an unrestricted upload feature that accepts any file type, enabling attackers to upload a web shell or other malicious script. This gives an attacker the ability to execute arbitrary code on the host, potentially leading to data theft, server defacement, or further compromise. The weakness maps to CWE‑434, which describes an Unrestricted Write to File or Directory vuln.

The WPify Woo Czech plugin, versions 5.4.1 and earlier, is affected. Any WordPress instance using this plugin and allowing users to upload files is vulnerable.

With a CVSS score of 9.9, the vulnerability is classified as critical. The EPSS score is not available, but the lack of a KEV listing does not reduce the risk to sites that expose the plugin upload interface. Attackers can exploit the flaw by submitting a malicious file through the upload form, thereby gaining remote code execution capabilities without additional privileges.