A severe security vulnerability has been identified in the TI WooCommerce Wishlist plugin for WordPress, potentially exposing over 100,000 active installations to cyberattacks. Security researchers at Patchstack have disclosed this unpatched flaw that allows unauthenticated attackers to upload malicious files to affected websites.

## Vulnerability Details

The critical vulnerability, tracked as CVE-2025-47577 with a maximum CVSS score of 10.0, affects all versions of the plugin up to and including 2.9.2 (released November 29, 2024). Currently, no patch is available to address this issue.

Researcher John Castro identified that the vulnerability exists in the “tinvwl_upload_file_wc_fields_factory” function. This function utilizes WordPress’s native “wp_handle_upload” function but disables crucial security checks by setting both “test_form” and “test_type” parameters to “false.” By disabling the “test_type” parameter, the plugin bypasses MIME type validation, allowing attackers to upload any file type, including malicious PHP files.

## Exploitation Conditions

For successful exploitation, two conditions must be met:
1. The WC Fields Factory plugin must be installed and activated on the WordPress site
2. The integration must be enabled on the TI WooCommerce Wishlist plugin

If these conditions are satisfied, attackers could potentially achieve remote code execution by uploading and accessing malicious PHP files.

## Recommendations

In the absence of an official patch, security experts recommend that users:
– Deactivate and delete the TI WooCommerce Wishlist plugin immediately
– For developers, avoid setting ‘test_type’ => false when using wp_handle_upload() in their code

Website administrators should take immediate action to protect their e-commerce platforms from this high-severity threat.