The vulnerability allows an authenticated or unauthenticated attacker to upload files of any type through the Booster for WooCommerce plugin, enabling the placement of executable code on the web server. If the uploaded file is designed as a web shell or contains malicious payloads, the attacker can achieve full control over the affected WordPress installation, compromising confidentiality, integrity, and availability. The weakness is classified as CWE‑434, indicating an improper handling of file uploads.

All WordPress sites running the Booster for WooCommerce plugin version 8.0.1 or earlier are affected. The vulnerability is present in any instance where the plugin's file upload functionality is reachable by a potential attacker, regardless of the WordPress theme or other plugins in use.

The CVSS score of 9.9 signals a critical severity and indicates that exploitation is likely to result in remote code execution. Although an EPSS score is not available, the high CVSS suggests the vulnerability is actively exploitable in the wild. The plugin is not listed in the CISA KEV catalog, but the arbitrary file upload still represents a substantial risk. The attack vector is inferred to be a web-based file upload endpoint exposed by the plugin, which can be abused without requiring privileged credentials, depending on the site’s configuration.