The Product Input Fields for WooCommerce plugin before version 2.0.2 does not properly validate file types during uploads if the accepted-types setting is left empty. This setting is documented to accept all file types, which enables unauthenticated attackers to upload arbitrary files. If the server hosting the plugin does not honor directory access restrictions, this vulnerability can be exploited to achieve remote code execution. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on affected servers. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid leaving the accepted-types setting empty or restrict file uploads through other means. Additionally, ensure that server directory access rules are properly enforced to mitigate the risk of remote code execution.