PT-2025-20546 · Woocommerce · Drag/Drop Multiple File Upload For Woocommerce

Rin Miyachi · Published 2025-05-09 · Updated 2026-04-08 · CVE-2025-4403

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress versions up to, and including, 1.1.6

Description The issue allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. This is due to the plugin accepting a user-supplied supported type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function.

Recommendations For versions up to, and including, 1.1.6, consider disabling the upload() function until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. Avoid using the supported type string and uploaded filename without proper validation and sanitization. Update to a version that includes a fix for this issue when available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-4403

Affected Products

Drag/Drop Multiple File Upload For Woocommerce

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-4403 · Security Note
• https://twitter.com/CVEnew/status/1920794036304310506 · Twitter Post
• https://t.me/cvedetector/24940 · Telegram Post
• https://t.me/cvenotify/121543 · Telegram Post
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L158 · Note
• https://twitter.com/threatsbank/status/1921068029091234278 · Twitter Post
• https://t.me/cvetracker/23475 · Telegram Post
• https://twitter.com/cybercronai/status/1920855126006280361 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3289478 · Note
• https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L360 · Note
• https://t.me/latest_high_impact_cve/2313 · Telegram Post
• https://twitter.com/cybercronai/status/1920840025576493525 · Twitter Post
• https://twitter.com/CCBalert/status/1925511344289202419 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/933dd704-5a31-42a9-9b87-bf14a9d4ffa9?source=cve · Note
• https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers · Note