PT-2025-42696 · Unknown+1 · Woocommerce+1

Talal Nasraddeen · Published 2025-10-18 · Updated 2026-02-13 · CVE-2025-11391

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce versions up to and including 33.0.15

Description The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the image cropper functionality. Unauthenticated attackers can exploit this to upload arbitrary files to the server, potentially leading to remote code execution. The issue specifically affected users with the paid version of the software installed and activated.

Recommendations Update PPOM – Product Addons & Custom Fields for WooCommerce to version 33.0.16 or newer.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-11391

Affected Products

Ppom – Product Addons & Custom Fields For Woocommerce

Woocommerce

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-11391 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve · Note
• https://twitter.com/0dayPublishing/status/1979440880948740492 · Twitter Post
• https://twitter.com/akaclandestine/status/1980561012869767231 · Twitter Post
• https://twitter.com/CveFindCom/status/1979444718724391322 · Twitter Post
• https://twitter.com/CveTodo/status/1979449602823598121 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45 · Note
• https://t.me/cveNotify/139329 · Telegram Post
• https://t.me/CVEtracker/35265 · Telegram Post
• https://twitter.com/akaclandestine/status/2022368574988341492 · Twitter Post