The vulnerability CVE-2024-22152 in WebToffee Product Import Export for WooCommerce (up to version 2.3.7) is an unrestricted file upload issue (CWE-434). It allows users with high privileges to upload files of dangerous types without proper restrictions, which can lead to severe impacts including full system compromise. The CVSS 3.1 base score is 8.0, reflecting high attack complexity and required privileges but with significant impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet.

Successful exploitation requires high privileges and no user interaction, but can result in complete compromise of the system's confidentiality, integrity, and availability. This means an attacker could upload malicious files that might execute arbitrary code or disrupt system operations. There are no known active exploits reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin features to trusted administrators only and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users who can access the import/export functionality.