The vulnerability in ecomerciar Woocommerce Custom Profile Picture plugin permits unrestricted file uploads without proper validation of file types. This can be exploited by an attacker with low privileges to upload malicious files such as web shells, resulting in remote code execution and full system compromise. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, privileges required, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the affected web server, leading to full compromise of the system. This includes unauthorized access to sensitive data, modification or deletion of data, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and consider disabling the plugin if possible. Monitor for updates from the vendor or trusted security sources to apply patches promptly once available.