This vulnerability (CVE-2025-69129) involves an unrestricted file upload flaw (CWE-434) in the Extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site, versions up to 1.0.7. It permits unauthenticated attackers to upload arbitrary files, including potentially malicious ones, which can lead to full compromise of the affected system. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without any authentication or user interaction, and the impact affects confidentiality, integrity, and availability at the highest level. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation allows unauthenticated attackers to upload arbitrary files of any type, potentially leading to remote code execution, full system compromise, data theft, and service disruption. The CVSS score of 10.0 reflects the critical nature and complete impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin functionality, disable or remove the plugin if possible, and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted networks or users.