The Veeqo for WooCommerce plugin up to version 2.2.8 has a flaw that allows any user with Subscriber-level permissions or higher to invoke its bridge‑installation routine. The plugin does not validate the URL it receives or restrict who can trigger the download and extraction stage, letting an attacker supply a custom archive that contains arbitrary PHP files. When extracted to the WordPress root, those files can be executed, giving the attacker the ability to run code with the web‑server’s privileges.

Veeqo for WooCommerce WordPress plugin versions 2.2.8 and earlier. The vulnerability affects WordPress sites that have installed the plugin and have users with Subscriber-level access.

The exploit can be performed via a normal web request, so anyone who can authenticate as a Subscriber or higher can trigger it. The CVSS score of 4.3 indicates moderate severity, and the EPSS score of < 1% shows a very low exploitation probability. The vulnerability is not listed in KEV, but the lack of input validation and the ability to write PHP files to the WordPress root imply a significant impact if exploited. The flaw allows remote code execution on the web server, granting attackers the ability to run arbitrary PHP code.