PT-2025-41674 · WordPress · Woocommerce Designer Pro

Tonn · Published 2025-10-11 · Updated 2025-10-16 · CVE-2025-6439

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions through 1.9.26

Description The WooCommerce Designer Pro plugin for WordPress is affected by an arbitrary file deletion issue. Insufficient file path validation in the wcdp save canvas design ajax function allows unauthenticated attackers to delete files in arbitrary directories on the server. This could lead to remote code execution, data loss, or site unavailability.

Recommendations Versions prior to and including 1.9.26 should be updated when a fix is available. As a temporary workaround, consider restricting access to the wcdp save canvas design ajax function until a patch is available.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6439

Affected Products

Woocommerce Designer Pro

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-6439 · Security Note
• https://t.me/CVEtracker/34667 · Telegram Post
• https://twitter.com/0dayPublishing/status/1976945657446297624 · Twitter Post
• https://twitter.com/offseq/status/1976951807675969845 · Twitter Post
• https://twitter.com/cracbot/status/1978777998976311395 · Twitter Post
• https://twitter.com/CveFindCom/status/1976945731798798794 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1977779337584648561 · Twitter Post
• https://twitter.com/SecAideInfo/status/1978041957424242909 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/407a0bc3-2775-4a34-9817-924bf94a4f94?source=cve · Note
• https://twitter.com/CveTodo/status/1976961102215893320 · Twitter Post
• https://twitter.com/CVEnew/status/1976948525629161869 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977042407309914590 · Twitter Post
• https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731 · Note