A critical arbitrary file upload vulnerability in the MIPL Grouped Checkout Fields for WooCommerce plugin allows unauthenticated attackers to achieve remote code execution.

The plugin fails to perform adequate file type validation within the mipl_wc_upload_file function. This allows unauthenticated attackers to upload malicious files to the server, which can be executed to gain full control over the site.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying web server. Given the CVSS score of 9.8, this poses a severe risk of total system compromise, including the theft of sensitive customer data, site defacement, and the potential for lateral movement within the hosting environment.

Immediate Action: Update the MIPL Grouped Checkout Fields for WooCommerce plugin to version 1.2.3 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting checkout endpoints and monitor the uploads directory for unexpected file types or scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads from unauthorized sources or to restrict file types to standard image formats.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing this plugin must prioritize the update to version 1.2.3 to eliminate the file upload vector. Failure to patch this flaw leaves the entire WordPress installation susceptible to complete compromise.