CVE-2026-53787 is a critical vulnerability in Amasty Order Attributes for Magento 2 prior to version 4.0.0. It permits unauthenticated attackers to upload arbitrary files to the media directory via an upload endpoint lacking authentication, session validation, or cart context checks. This unrestricted file upload can lead to remote code execution on servers where PHP execution is allowed in the media directory. Additional impacts include malware hosting, stored XSS through HTML or SVG files, and path traversal to write files outside the intended directory.

The vulnerability allows unauthenticated attackers to write arbitrary files to the Magento store's media directory. If PHP execution is enabled in this directory, attackers can achieve remote code execution, compromising the server. Even without PHP execution, attackers can host malicious files, perform stored cross-site scripting attacks, or use path traversal to place files outside the upload directory, potentially leading to further compromise or defacement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable PHP execution in the media directory as a mitigation measure. Monitor for updates from Amasty regarding patches or official fixes and apply them promptly once released.