A critical unrestricted file upload vulnerability in WoowBot Pro Max enables authenticated attackers to execute arbitrary code on the host server.

This issue is an Unrestricted Upload of File with Dangerous Type (CWE-434). An attacker with low privileges can bypass file validation mechanisms to upload and execute malicious files on the server, as confirmed by the CVSS vector (PR:L).

With a CVSS score of 9.9, this vulnerability represents an extreme risk. An attacker gaining the ability to upload and execute code on the server could achieve a full system compromise, resulting in data theft, malware distribution, or complete service outage.

Immediate Action: Update the WoowBot Pro Max plugin to the latest version as soon as a patch is available from the vendor. Disable the plugin immediately if the current version is vulnerable and cannot be updated.

Proactive Monitoring: Inspect the web server’s upload directories for unexpected or non-standard file types. Monitor server logs for unusual file execution events or unauthorized access to uploaded content.

Compensating Controls: Implement strict file type validation at the WAF level and ensure the web server is configured to prevent the execution of scripts in user-accessible upload directories.

Public Exploit Available: No (exploit_available: false)

This vulnerability requires immediate attention due to the high risk of remote code execution. Administrators should apply the vendor-provided patch immediately upon release and enforce strict file upload policies to mitigate the risk of exploitation.