Attack Chain

1. An attacker identifies a WordPress site running the Checkout Files Upload plugin with an empty "Accepted file types" configuration.
2. The attacker visits the checkout page to retrieve a valid nonce for the wpwham-checkout-files-upload-0 action.
3. The attacker submits a multipart/form-data request to /wp-admin/admin-ajax.php containing the nonce, file_uploader identifier, and a malicious PHP file.
4. The plugin stores the malicious file in a temporary location and moves it to wp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/ upon order creation or submission.
5. The attacker requests the uploaded PHP file directly via the web server to execute arbitrary code with the privileges of the web service user.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.

Recommendation

• Update the "Checkout Files Upload for WooCommerce" plugin to version 2.4.0 or later immediately.
• If immediate patching is not possible, configure an explicit "Accepted file types" allow-list (e.g., jpg,jpeg,png,pdf) for every uploader instance in the plugin settings.
• Block direct PHP execution in the uploads directory by adding the following directive to your web server configuration (Nginx or Apache) to prevent webshell execution.
• Audit the wp-content/uploads/woocommerce_uploads/alg_uploads/checkout_files_upload/ directory for any unexpected files.