This vulnerability in the ReachShip WooCommerce Multi-Carrier & Conditional Shipping plugin permits unrestricted upload of files with dangerous types, which can be used by attackers to upload malicious files. The issue affects all versions up to 4.3.1. The CVSS 3.1 score of 9.9 reflects that the vulnerability can be exploited remotely with low complexity and no user interaction, requiring only low privileges, and can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to upload and execute malicious files on the affected system, potentially leading to full system compromise including data theft, data modification, and denial of service. The vulnerability affects the confidentiality, integrity, and availability of the impacted environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting file upload functionality in the plugin or applying other access controls to limit exposure. Monitor official ELEXtensions channels for updates and patches.