The vulnerability CVE-2026-42748 in WPify Woo Czech permits attackers with at least low privileges to upload files of dangerous types without restriction. This can enable uploading a web shell, which may allow remote code execution and full system compromise. The issue affects all versions up to 5.4.1. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed at this time.

Successful exploitation allows an attacker to upload a web shell to the web server, potentially leading to remote code execution, full system compromise, data theft, and service disruption. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to trusted administrators only. Consider disabling or removing the WPify Woo Czech plugin if not essential. Monitor for suspicious file uploads and web shell indicators as interim protective measures.