Arbitrary File Deletion Vulnerability in WooCommerce Designer Pro Plugin by WordPress

CVE-2025-6439

What is CVE-2025-6439?

The WooCommerce Designer Pro plugin for WordPress contains a vulnerability that allows unauthenticated users to delete files from arbitrary directories on the server due to inadequate file path validation in the 'wcdp_save_canvas_design_ajax' function. This flaw impacts all versions up to and including 1.9.26, potentially leading to severe security issues such as remote code execution, data loss, or total unavailability of the website.

References