The payever WooCommerce Gateway plugin is vulnerable to an unattended file upload flaw that allows an attacker to place an arbitrary PHP script in the public uploads directory. Four WooCommerce‑API callbacks—payever_set_sandbox_api_keys, payever_toggle_subscription, and payever_synchronization_incoming—are registered with no authentication, capability check or nonce. The upload_image routine writes the file using an attacker‑controlled basename before validating the MIME type, letting unauthenticated users deploy code and execute it remotely.

All instances of the payever Checkout – Composable Payment Gateway plugin for WordPress with a version of 4.8.0 or earlier are affected. The flaw exists in the core plugin code distributed up to and including 4.8.0; any site running that or earlier releases is at risk.

The flaw carries a CVSS score of 9.8, indicating critical severity, and is not currently listed in CISA's KEV catalog. Although an EPSS score is not available, the public information demonstrates that the issue is widely exploitable through the open API callbacks. An attacker requires only network access to the site; no user credentials are necessary. If the plugin’s outbound validateToken() call is bypassed, a second independent vulnerability (hard‑coded credential overwrite) can also be leveraged.