The vulnerability identified as CVE-2025-10412 affects the Uni CPO (Premium) plugin for WooCommerce by MooMoo. It stems from a misconfiguration in the file upload validation logic within the 'uni_cpo_upload_file' function, allowing unauthenticated attackers to upload arbitrary files. This unrestricted file upload can enable remote code execution on the server hosting the affected WordPress site. The vulnerability is present in all versions up to and including 4.9.55. The CVSS v3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no required privileges or user interaction. No patch or official fix has been documented in the provided data, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and can result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable file upload functionality, applying web application firewall (WAF) rules to block malicious uploads, and monitoring for suspicious activity related to file uploads. Avoid using affected versions in production environments where possible.