Unauthenticated Arbitrary File Upload Vulnerability in WooCommerce Extra Product Options Plugin

CVE-2024-7257

Summary

The YayExtra WooCommerce Extra Product Options plugin for WordPress has a vulnerability that allows arbitrary file uploads due to missing file type validation in its handle_upload_file function. This weakness is present in all versions up to and including version 1.3.7. Unauthenticated attackers can exploit this flaw to upload arbitrary files to the server where the affected site is hosted. Consequently, this could potentially lead to remote code execution, posing a significant risk to website integrity and security. Immediate action is recommended to mitigate potential threats associated with this vulnerability.

References