The Booster for WooCommerce plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'add_files_to_order' function. This flaw allows unauthenticated attackers to upload arbitrary files with dangerous double extensions because the plugin lacks proper file type validation. Exploitation depends on specific server configurations that execute the first extension in a double extension filename, which may enable remote code execution. The vulnerability affects all versions up to and including 7.2.4. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary file upload, which may result in remote code execution on affected servers under certain configurations. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity due to specific server configuration requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and review server configurations to prevent execution of files based on the first extension in double extensions. Monitor for updates from the vendor and apply patches promptly once released.