The StoreEngine WordPress plugin suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability arises from the import() function lacking proper file type validation, enabling authenticated users with low privileges (Subscriber and above) to upload arbitrary files. This can potentially allow attackers to execute remote code on the server hosting the plugin. The issue affects all versions up to 1.5.0. No known exploits are reported in the wild as of the publication date. No patch or official fix has been documented yet.

Successful exploitation allows an authenticated user with minimal privileges to upload arbitrary files, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the plugin's role in eCommerce and membership management, exploitation could result in significant business disruption and data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles that have upload capabilities, monitor for suspicious file uploads, and consider disabling the import functionality if feasible. Avoid granting Subscriber-level or higher access to untrusted users.