PT-2025-15058 · WordPress · Drag/Drop Multiple File Upload For Woocommerce

Published 2025-04-05 · Updated 2026-04-08 · CVE-2025-2941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress versions up to, and including, 1.1.4

Description The issue is due to insufficient file path validation via the wc-upload-file[] parameter, making it possible for unauthenticated attackers to move arbitrary files on the server. This can lead to remote code execution when the right file is moved, such as wp-config.php. The vulnerability is related to improper limitation of a pathname to a restricted directory, also known as path traversal.

Recommendations For versions up to, and including, 1.1.4, update to a version later than 1.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the wc-upload-file[] parameter to prevent unauthenticated file moves. Additionally, restrict access to sensitive files such as wp-config.php to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2941

Affected Products

Drag/Drop Multiple File Upload For Woocommerce

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-2941 · Security Note
• https://twitter.com/CVEnew/status/1908438430150766592 · Twitter Post
• https://t.me/latest_high_impact_cve/2078 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2685a2b4-aba3-425b-af0d-06f7693ab3d7?source=cve · Note
• https://twitter.com/CveFindCom/status/1909155734610194795 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&new=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&sfp_email=&sfph_mail= · Note
• https://twitter.com/cybercronai/status/1908580916386988263 · Twitter Post
• https://t.me/cvetracker/20887 · Telegram Post
• https://twitter.com/0dayPublishing/status/2041924413004656775 · Twitter Post
• https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers · Note
• https://t.me/cvedetector/22187 · Telegram Post
• https://twitter.com/cybercronai/status/1908566646928588870 · Twitter Post