The vulnerability CVE-2025-22782 affects the WR Price List Manager for WooCommerce plugin, allowing unrestricted upload of files with dangerous types. This enables an attacker with low privileges to upload a web shell to the server, potentially leading to full system compromise. The issue affects all versions up to and including 1.0.8. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload malicious files such as web shells to the web server, resulting in full compromise of the affected system. This includes complete loss of confidentiality, integrity, and availability of the system and data hosted on it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and monitor for suspicious uploads if possible. Avoid using affected versions of the plugin in production environments.