The vulnerability CVE-2026-28114 in firassaidi WooCommerce License Manager allows unrestricted upload of files with dangerous types, such as web shells, due to insufficient validation or restrictions on uploaded file types. This enables an attacker with high privileges to execute arbitrary code on the server, potentially leading to full system compromise. The affected versions include all versions up to and including 7.0.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to upload malicious files, such as web shells, to the server hosting the WooCommerce License Manager plugin. This can result in complete compromise of the web server, including unauthorized access, data theft, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and consider disabling file upload functionality if not required. Monitor for suspicious file uploads and remove any unauthorized files promptly.