PT-2025-39159 · Woocommerce+1 · Woocommerce+2

Ren Voza · Published 2025-09-23 · Updated 2025-09-24 · CVE-2025-10412

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) versions through 4.9.54

Description The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress has an issue with file type validation. Specifically, the uni cpo upload file function allows unauthenticated attackers to upload arbitrary files to the server. This could potentially lead to remote code execution.

Recommendations Update to a version later than 4.9.54.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-10412

Affected Products

Uni Cpo

Woocommerce

Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-10412 · Security Note
• https://moomoo.agency/cpo · Note
• https://twitter.com/ZeroPathLabs/status/1970440242998935784 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1c0c6a45-2c4a-4a23-84e6-7a9759796824?source=cve · Note
• https://twitter.com/CVEnew/status/1970621821239337415 · Twitter Post
• https://t.me/cveNotify/136124 · Telegram Post
• https://twitter.com/NightfallCVE/status/1970840651001692234 · Twitter Post
• https://t.me/CVEtracker/33155 · Telegram Post
• https://builderius.io/cpo · Note
• https://twitter.com/CveFindCom/status/1970422786704167013 · Twitter Post