Data Loss Risk in WooCommerce Plugin from Uni CPO

CVE-2025-13391

What is CVE-2025-13391?

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO plugin allows unauthorized file deletion due to a missing capability check in the 'uni_cpo_remove_file' function. This vulnerability affects all versions up to and including 4.9.60, enabling unauthenticated attackers to potentially delete files or attachments stored in external locations like Dropbox if they know the file path. While a partial fix was introduced in version 4.9.60, users should ensure they are running the latest version to mitigate risks.

References