A critical arbitrary file upload vulnerability in the StoreKeeper for WooCommerce plugin enables unauthenticated remote code execution, posing a severe threat to site integrity.

This vulnerability is an Unrestricted Upload of File with Dangerous Type (CWE-434). It allows an unauthenticated attacker to bypass file validation and upload arbitrary files, which can be executed on the server.

Successful exploitation grants an attacker full control over the WordPress environment, potentially leading to total system compromise, data theft, and site defacement. Given the CVSS score of 10.0, this vulnerability is critical and requires immediate attention to prevent unauthorized access to sensitive customer and administrative data.

Immediate Action: Update the StoreKeeper for WooCommerce plugin to version 14.4.5 or later immediately.

Proactive Monitoring: Review web server and WordPress logs for unusual file upload activity or requests pointing to suspicious file paths within the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious file uploads and restrict access to executable files in the upload directory.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, makes immediate patching mandatory. Administrators should prioritize updating the StoreKeeper for WooCommerce plugin to version 14.4.5 across all instances to eliminate the risk of remote code execution.