WooCommerce Designer Pro Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the WooCommerce Designer Pro plugin for WordPress, specifically in versions through 1.9.26. This issue arises from inadequate file type validation in the 'wcdp_save_canvas_design_ajax' function. As a result, unauthenticated attackers can upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.