The sidngr Import Export For WooCommerce plugin versions up to 1.6.2 contain an unrestricted file upload vulnerability that allows authenticated users with low privileges to upload files of dangerous types, including web shells. This can lead to remote code execution on the affected web server. The vulnerability is critical with a CVSS 3.1 score of 9.9, indicating network attack vector, low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability. No patch or official fix details are currently available from the vendor or advisory sources.

Successful exploitation allows an attacker to upload a web shell, resulting in full remote code execution on the web server hosting the WooCommerce plugin. This compromises the confidentiality, integrity, and availability of the affected system and potentially the entire web application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's upload functionality to trusted users only and consider disabling the plugin if feasible. Monitor for unusual file uploads and web shell indicators as a temporary measure.