CVE-2024-13359 is a high-severity vulnerability (CVSS 8.1) in the Product Input Fields for WooCommerce WordPress plugin caused by insufficient validation of uploaded file types in the add_product_input_fields_to_order_item_meta() function. This allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution. The vulnerability primarily allows double extension file uploads unless the administrator misconfigures accepted file extensions, which can permit direct .php uploads. Versions up to 1.12.0 are affected; version 1.12.1 is fully patched. No official patch links were provided in the data, and no known exploits are currently reported.

Successful exploitation can lead to arbitrary file upload on the server hosting the WordPress site, which may enable remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity due to default file extension restrictions.

Upgrade to version 1.12.1 or later, which is confirmed to fully patch this vulnerability. Administrators should ensure the accepted file extensions field is not left blank to prevent direct .php file uploads. Since no official patch links were provided, verify the vendor's official advisory or update channels for the patched version. Monitor vendor communications for any additional guidance.