The PPOM – Product Addons & Custom Fields for WooCommerce plugin contains an unrestricted file upload vulnerability (CWE-434) in its image cropper functionality. This flaw exists in all versions up to and including 33.0.15 and allows unauthenticated attackers to upload arbitrary files to the server. The vulnerability is present in the free version's code but only impacts users running the paid version. Successful exploitation may enable remote code execution, posing a critical risk to affected sites. No patch or vendor advisory detailing remediation is currently available.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution on the affected server. This compromises confidentiality, integrity, and availability of the system. The vulnerability is critical with a CVSS score of 9.8. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users of the paid version of the PPOM plugin should consider disabling or removing the plugin to prevent exploitation. Monitor official themeisle channels for updates and apply patches promptly once available.