Checkout Files Upload for WooCommerce Plugin Arbitrary File Upload RCE

The Checkout Files Upload for WooCommerce WordPress plugin contains an arbitrary file upload vulnerability that can lead to remote code execution.

Before version 2.4.0, the plugin does not validate uploaded file types when its accepted file types setting is left empty. That empty setting is documented as the way to accept all files.

• Unauthenticated users can upload arbitrary files, including PHP files.
• On servers that execute PHP from the uploads directory, this can result in remote code execution.