The Woffice Core plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'saveFeaturedImage' function. This vulnerability allows authenticated users with low privileges (Subscriber-level and above) to upload arbitrary files without proper validation of file types. Such capability may enable attackers to execute remote code on the server hosting the affected WordPress site. The issue affects all versions up to 5.4.21. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

An attacker with Subscriber-level access or higher can upload arbitrary files to the server due to lack of file type validation. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network with low complexity and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to minimize exposure. Monitor for suspicious file uploads and consider disabling or restricting the 'saveFeaturedImage' functionality if feasible.