The vulnerability CVE-2025-47687 in StoreKeeper for WooCommerce permits unauthenticated attackers to upload files of dangerous types without restriction. This can allow an attacker to upload a web shell to the web server, resulting in full system compromise. The affected versions include all versions up to 14.4.4. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker to upload arbitrary files, including web shells, to the web server hosting the StoreKeeper for WooCommerce plugin. This can lead to full compromise of the affected system, including unauthorized access, data theft, data modification, and service disruption. The vulnerability is critical with a CVSS score of 10.0, indicating maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the StoreKeeper for WooCommerce plugin if possible, and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users. Follow vendor communications closely for updates on patches or official mitigations.