TemplateInvaders TI WooCommerce Wishlist is a WordPress plugin used to manage wishlists. This vulnerability allows attackers to upload a web shell to the server by exploiting an unrestricted file upload feature in the template editor. If you use this plugin, you're at risk of having your server compromised remotely.
You're affected if you use Unrestricted Upload of File with Dangerous Type vulnerability. Affected versions: 2.10.0 If you don't recognise this software, you're probably not affected.
To fix this vulnerability, upgrade to TI WooCommerce Wishlist version 2.10.0 or later. If an immediate upgrade isn't possible:
- Restrict network access to your WordPress installation (firewall it from the public internet)
- Audit plugin activity for suspicious file uploads