PT-2025-47711 · Woocommerce+1 · Woocommerce+1

Moose Love

·

Published

2025-11-21

·

Updated

2025-12-09

·

CVE-2025-13156

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Vitepos – Point of Sale (POS) for WooCommerce versions up to and including 3.3.0
Description The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation within the insert media attachment() function. Specifically, the save update category img() function accepts user-supplied file types without validation when processing category images. This allows authenticated attackers with subscriber-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution. The vulnerability affects point of sale systems that handle payment data, making file upload leading to remote code execution a critical issue.
Recommendations Versions up to and including 3.3.0 should be updated to version 3.3.1 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13156

Affected Products

Vitepos
Woocommerce