The YayExtra – WooCommerce Extra Product Options plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) due to lack of file type validation in the handle_upload_file function in versions up to 1.3.7. This flaw allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the affected server. The vulnerability is publicly documented as CVE-2024-7257 with a CVSS 3.1 base score of 9.8, reflecting its critical severity and ease of exploitation over the network without privileges or user interaction. No patch or official remediation has been disclosed yet.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable plugin, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or restrict file upload functionality in the plugin or remove the plugin if not essential. Monitor official yaycommerce communications for updates and apply patches promptly once available.