File Uploader for WooCommerce Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability exists in the File Uploader for WooCommerce plugin for WordPress, allowing unauthenticated users to upload arbitrary files. This issue arises from inadequate file type validation in the callback function for the 'add-image-data' REST API endpoint, affecting all versions up to and including 1.0.3. Exploitation of this vulnerability could lead to remote code execution, as uploaded files are sent to the Uploadcare service and can be downloaded to the affected site's server.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, potentially leading to remote code execution on the server.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.