Arbitrary File Upload Vulnerability in WooCommerce Plugin by WordPress
CVE-2025-4403
What is CVE-2025-4403?
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads in all versions up to and including 1.1.6. This vulnerability arises from the plugin's failure to rigorously validate user-supplied inputs related to file uploads, specifically bypassing real extension or MIME type checks in the upload() function. Consequently, this flaw allows unauthenticated attackers to upload arbitrary files to the server hosting the affected site, potentially enabling remote code execution and posing serious security risks.
Affected Version(s)
Drag and Drop Multiple File Upload for WooCommerce * <= 1.1.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved