The vulnerability CVE-2025-48148 in StoreKeeper for WooCommerce allows an attacker to upload files of dangerous types without restriction. This can lead to remote code execution or full compromise of the affected system. The issue affects all versions up to 14.4.4. The CVSS score of 10.0 reflects the critical nature of this vulnerability, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow an unauthenticated attacker to upload malicious files, potentially leading to remote code execution, full system compromise, data theft, or service disruption. The critical CVSS score indicates maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and consider disabling the StoreKeeper for WooCommerce plugin if possible. Monitor for updates from StoreKeeper B.V. and apply patches promptly once released.