This vulnerability (CVE-2024-30231) in the WebToffee Product Import Export for WooCommerce plugin permits attackers with high privileges to upload files of dangerous types without restriction. The issue affects all versions up to 2.4.1. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No official fix or patch has been published yet, and the vendor has not provided a remediation advisory. The plugin is not a cloud service, so remediation depends on the vendor releasing an update.

Successful exploitation could allow an attacker with high privileges to upload malicious files, potentially leading to full system compromise including data theft, data manipulation, and service disruption. The critical CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system. Since the vulnerability involves unrestricted file upload, it may facilitate remote code execution or other attacks if combined with other weaknesses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin to trusted administrators only and monitor for suspicious file uploads. Avoid using the affected plugin versions in production environments if possible. Follow vendor channels closely for updates and apply official patches immediately once released.