CVE-2024-1986 is a CWE-434 vulnerability in the Booster Elite for WooCommerce plugin for WordPress, affecting all versions up to and including 7.1.7. The issue arises from the lack of file type validation in the wc_add_new_product() function, enabling authenticated users with customer-level access or above to upload arbitrary files. This can lead to remote code execution if the product upload functionality is enabled on the site. The vulnerability is network exploitable with low attack complexity and no user interaction required. Confidentiality, integrity, and availability impacts are all rated high.

Successful exploitation allows an attacker with at least customer-level permissions to upload arbitrary files to the server hosting the WordPress site. This can result in remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is significant due to the potential for full system compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the product upload functionality if enabled, and restrict user permissions to minimize exposure. Monitor vendor channels for updates and apply patches promptly once available.