CyberRota Analysis
AI-GeneratedThe Product Input Fields for WooCommerce plugin for WordPress prior to version 2.0.2 is vulnerable due to inadequate validation of uploaded file types when the accepted-types setting is left empty, permitting unauthenticated attackers to upload arbitrary files. This flaw can lead to remote code execution on servers that do not enforce strict directory access controls. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.