The vulnerability CVE-2025-60207 affects the Addify Custom User Registration Fields for WooCommerce plugin (<= 2.1.2). It permits an attacker to upload files of dangerous types without restriction, which can lead to uploading a web shell on the target web server. This results in full compromise of the affected system. The vulnerability is remotely exploitable without authentication or user interaction, and it has a critical CVSS score of 10.0. No official patch or mitigation guidance is currently available from the vendor or other authoritative sources.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, leading to full compromise of the web server. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is critical and can be exploited remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting file upload functionality in the affected plugin or removing the plugin entirely to prevent exploitation.