Arbitrary File Upload Vulnerability in WooCommerce Plugin by WordPress
CVE-2025-11391
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 October 2025
What is CVE-2025-11391?
The Product Addons & Custom Fields for WooCommerce plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation in its image cropper functionality. This flaw is present in all versions up to and including 33.0.15. It allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution. Note that while this vulnerability is in the free version, it primarily impacts users who have activated the paid version of the plugin.
Affected Version(s)
PPOM – Product Addons & Custom Fields for WooCommerce * <= 33.0.15