The Amin Omer Sudan Payment Gateway for WooCommerce plugin versions up to 1.2.2 contain an unrestricted file upload vulnerability that permits attackers to upload malicious files such as web shells. This vulnerability can be exploited remotely without authentication or user interaction, resulting in full compromise of the affected web server. The issue is categorized as critical with a CVSS 3.1 base score of 10. No vendor advisory or patch links are currently available, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the web server hosting the vulnerable WooCommerce plugin. This can lead to complete system compromise, including full control over the server, data theft, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or uninstalling the vulnerable plugin to prevent exploitation. Monitoring for suspicious file uploads and restricting file upload permissions may provide temporary risk reduction but do not fully mitigate the vulnerability.