The upload_image() routine within these callbacks fetches a file from a remote URL and writes it to the public WordPress uploads directory. Because the filename is derived from attacker-controlled input using basename() before the file type is validated, an attacker can force the plugin to write an executable PHP file to the server.

Impact

An unauthenticated remote attacker can upload arbitrary PHP scripts to the web server, leading to full remote code execution.

Recommendation

• Update the "payever - WooCommerce Gateway" plugin to the latest available version beyond 4.8.0.
• Implement access controls or WAF rules to restrict access to the WooCommerce API callbacks mentioned.
• Audit the /wp-content/uploads/ directory for suspicious PHP files or scripts that were uploaded recently.