The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability (CWE-434) in the wcap_add_to_cart_popup_upload_files function. This flaw exists in all versions up to and including 9.16.0 and allows an attacker with subscriber-level privileges or higher to upload files without proper validation of file types. The uploaded files could be used to execute code remotely or locally on the affected server, depending on server settings. The vulnerability is publicly known as CVE-2025-4387 with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no vendor advisory or patch link currently available, and no known exploits in the wild have been reported.

An attacker with at least subscriber-level access can upload arbitrary files to the affected server, potentially leading to remote or local code execution. This can compromise the confidentiality, integrity, and availability of the affected system. The severity is high due to the ease of exploitation (low attack complexity) and the significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious file uploads. Avoid granting unnecessary upload privileges to low-privileged users. Follow updates from Tyche Softwares for any forthcoming patches or official mitigations.