An arbitrary file upload vulnerability in the WordPress Extra Checkout Options plugin allows authenticated attackers to execute malicious code, potentially leading to a full site takeover.

The plugin contains an arbitrary file upload vulnerability (CWE-434) that permits attackers with low-level privileges to upload files with dangerous extensions. This flaw stems from insufficient validation of uploaded content within the plugin.

This vulnerability carries a CVSS score of 8.8, indicating a high risk of total site compromise. An authenticated attacker could upload a web shell or other malicious script, resulting in unauthorized data access, modification, or complete control over the compromised WordPress installation and the underlying server.

Immediate Action: Update the Extra Checkout Options plugin to version 2.3.3 or later immediately.

Proactive Monitoring: Check the WordPress media library and upload directories for files with unexpected extensions or suspicious names that may indicate unauthorized activity.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized file uploads and restrict access to the WordPress administrative and configuration interfaces.

Public Exploit Available: Unknown.

Due to the critical risk of arbitrary code execution, it is imperative that site administrators update the plugin to the latest version immediately. If an update cannot be applied promptly, consider deactivating the plugin to prevent potential exploitation until a patch is implemented.