Admin and Customer Messages After Order for WooCommerce Limited File Upload Vulnerability

A vulnerability exists in the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress, in all versions through 13.2. The issue arises from inadequate validation of file types in the upload_file() function, allowing authenticated attackers with Subscriber-level access and above to upload files to the server. This vulnerability could potentially lead to remote code execution and has been confirmed to allow Cross-Site Scripting.

Impact

Exploitation of this vulnerability could result in Cross-Site Scripting, with the potential for remote code execution.

Remediation

Users are advised to update the plugin to version 13.3 or a newer patched version.