The vulnerability CVE-2025-47577 in the TI WooCommerce Wishlist plugin permits unauthenticated attackers to upload files of dangerous types without restriction. This can result in the upload of web shells, allowing attackers to execute arbitrary code on the web server. The issue affects all versions up to 2.9.2. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation allows remote attackers to upload and execute arbitrary code on the affected web server, potentially leading to full system compromise, data theft, or service disruption. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict file upload permissions, disable or limit the use of the affected plugin, and monitor for suspicious activity related to file uploads. Avoid exposing the affected plugin to untrusted users or networks.