The Advanced Woo Labels plugin for WordPress contains a critical remote code execution vulnerability that allows authenticated contributors to execute arbitrary PHP functions and system commands.

The vulnerability exists in the get_select_option_values AJAX handler, which utilizes call_user_func_array with user-controlled input without an allowlist or capability check. This allows any authenticated user with Contributor-level access or higher to inject and execute arbitrary PHP code on the underlying server.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the web server, leading to a total compromise of the application. The potential impact includes unauthorized data access, modification of site content, and the ability to pivot into the broader network infrastructure. Given the CVSS score of 8.8, this flaw represents a significant risk to organizational integrity and data confidentiality.

Immediate Action: Update the Advanced Woo Labels plugin to version 2.37 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor WordPress access logs and AJAX request patterns for suspicious parameters involving unexpected callback functions or system-level command strings.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected AJAX endpoint or to restrict access to administrative AJAX handlers to trusted user roles only.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the Advanced Woo Labels plugin must prioritize updating to version 2.37 or higher as the primary defense against this vulnerability. Because this flaw is accessible to any user with Contributor-level privileges, it is imperative to audit current user roles and permissions while the update process is underway. Failure to patch will leave the environment exposed to potential full system takeover by malicious actors.