CVE-2025-13329 is a critical vulnerability in the snowray File Uploader for WooCommerce WordPress plugin. The vulnerability arises from the lack of file type validation in the callback function for the 'add-image-data' REST API endpoint, allowing unauthenticated attackers to upload arbitrary files to the Uploadcare service. These files can then be downloaded onto the affected site's server, potentially enabling remote code execution. The issue affects all versions up to and including 1.0.3. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability. No patch or remediation is currently available according to the provided data.

An attacker can upload arbitrary files without authentication, which may lead to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to its ease of exploitation and severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable REST API endpoint if possible, and monitor for suspicious file uploads. Avoid using affected versions of the plugin in production environments where possible.