Authenticated Arbitrary File Upload Vulnerability in Abandoned Cart Pro for WooCommerce

CVE-2025-4387

What is CVE-2025-4387?

The Abandoned Cart Pro for WooCommerce plugin has a vulnerability that allows authenticated users with subscriber-level access and above to upload arbitrary files due to insufficient file type validation in the wcap_add_to_cart_popup_upload_files function. This issue exists in all versions up to and including 9.16.0, potentially enabling the execution of malicious code on the server, whether remotely or locally, depending on server configurations.

References