Drag and Drop Multiple File Upload for WooCommerce WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress, affecting all versions through 1.1.6. The issue arises because the plugin's upload function accepts user-supplied data without proper validation of file extensions or MIME types. This flaw enables unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.