The vulnerability CVE-2026-28114 affects the firassaidi WooCommerce License Manager plugin up to version 7.0.6. It allows an attacker with high privileges to upload files with dangerous types without restriction, including potentially malicious web shells. This can result in full system compromise, affecting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on system security properties. No official patch or mitigation guidance is currently provided.

Successful exploitation allows an attacker with high privileges to upload arbitrary files, including web shells, to the web server hosting the WooCommerce License Manager plugin. This can lead to full compromise of the server, including unauthorized access, data theft, modification, and denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to users with high privileges and monitor for suspicious file uploads. Consider disabling the plugin if possible or restricting file upload functionality as a temporary measure.