Arbitrary File Deletion Vulnerability in WooCommerce Designer Pro Plugin by WordPress
CVE-2025-6439
9.8CRITICAL
What is CVE-2025-6439?
The WooCommerce Designer Pro plugin for WordPress contains a vulnerability that allows unauthenticated users to delete files from arbitrary directories on the server due to inadequate file path validation in the 'wcdp_save_canvas_design_ajax' function. This flaw impacts all versions up to and including 1.9.26, potentially leading to severe security issues such as remote code execution, data loss, or total unavailability of the website.
Affected Version(s)
WooCommerce Designer Pro * <= 1.9.26
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Tonn