A critical vulnerability in the Product Input Fields for WooCommerce plugin allows unauthenticated remote code execution via unrestricted file uploads.

This flaw is an Unrestricted Upload of File with Dangerous Type (CWE-434). Due to improper validation of uploaded file types when the accepted-types setting is empty, unauthenticated attackers can upload malicious scripts to the server.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the underlying server, potentially leading to a full system compromise. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data confidentiality, integrity, and availability, which could result in significant business disruption and unauthorized access to sensitive customer information.

Immediate Action: Update the Product Input Fields for WooCommerce plugin to version 2.0.2 or later immediately.

Proactive Monitoring: Review web server access logs for unusual POST requests targeting file upload endpoints and inspect upload directories for unexpected executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads or restrict access to plugin directories that allow direct execution of uploaded scripts.

Public Exploit Available: No confirmed public exploit is available in our curated sources.

This vulnerability represents a critical security risk due to the potential for unauthenticated remote code execution. Administrators must prioritize updating the plugin to version 2.0.2 immediately to neutralize the threat. Failure to patch this flaw leaves the application exposed to complete system takeover by unauthorized external actors.