This vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) for WooCommerce permits unauthenticated attackers to upload files of dangerous types without restriction. Specifically, it allows uploading web shells, which can be executed on the server, leading to full system compromise. The affected versions include all versions up to and including 5.0.6. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server via a web shell, resulting in full system compromise. This includes unauthorized access to sensitive data, modification or deletion of data, and disruption of service. The vulnerability is critical due to its ease of exploitation and severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the upload functionality, disable the plugin if possible, or implement strict file upload filtering and monitoring to prevent dangerous file types from being uploaded.