The vulnerability arises from the ppom_upload_file function lacking proper file type validation, enabling arbitrary file uploads. Attackers can leverage this to upload malicious files to the server. However, exploitation requires the presence of the PPOM Pro plugin and a WooCommerce product configured with a file upload field to retrieve the correct nonce, which is necessary for the attack to proceed. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can upload arbitrary files to the server hosting the vulnerable plugin, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The attack requires specific conditions (PPOM Pro installed and a WooCommerce product with a file upload field) but does not require user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling file upload fields in WooCommerce products using PPOM. Monitor vendor channels for updates and apply patches promptly once released.