This vulnerability (CVE-2024-22135) in the WebToffee Order Export & Order Import for WooCommerce plugin allows an attacker with high privileges to upload files without proper restrictions on file types. This unrestricted file upload can enable execution of malicious code or other harmful actions. The issue affects all versions up to 2.4.3. The CVSS 3.1 base score is 8.0, indicating high severity, with attack vector network, high attack complexity, requiring privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation could allow an attacker with high privileges to upload and potentially execute malicious files on the server hosting the WooCommerce plugin. This can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 8.0. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted administrators only and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users who can access the plugin's upload functionality.