The vulnerability CVE-2025-29009 affects the Webkul Medical Prescription Attachment Plugin for WooCommerce, allowing an attacker to upload files of dangerous types without restriction. This can include web shells, which can be used to execute arbitrary code on the affected web server. The issue affects all versions up to and including 1.2.3. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a critical impact on the confidentiality, integrity, and availability of the affected system. No patch or vendor advisory has been provided to confirm remediation status.

Successful exploitation allows an unauthenticated attacker to upload malicious files such as web shells to the web server hosting the vulnerable plugin. This can lead to complete compromise of the web server, including unauthorized access, data theft, data modification, and potential disruption of service. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting its critical severity and the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict file upload permissions, implement web application firewall (WAF) rules to block malicious file uploads, and monitor for suspicious activity related to file uploads. Avoid exposing the affected plugin to untrusted users or networks where possible.