PT-2025-52536 · Unknown+1 · Woocommerce+1

Md. Moniruzzaman Prodhan + 1 · Published 2025-12-20 · Updated 2025-12-31 · CVE-2025-13329

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Uploader for WooCommerce versions up to and including 1.0.3

Description The File Uploader for WooCommerce plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the callback function associated with the /add-image-data API endpoint. This allows unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them to the affected site's server, potentially leading to remote code execution. The vulnerability is present in the add-image-data API endpoint and involves a missing check on the file parameter.

Recommendations Versions up to and including 1.0.3: Update the plugin to a version beyond 1.0.3.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13329

Affected Products

File Uploader For Woocommerce

Woocommerce

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-13329 · Security Note
• https://twitter.com/CVEnew/status/2002466747245342781 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2006356531374121136 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3423070/file-uploader-for-woocommerce/trunk/src/Helpers/class-uploaderhelper.php · Note
• https://twitter.com/TheHackerWire/status/2002243423345193315 · Twitter Post
• https://t.me/CVEtracker/40336 · Telegram Post
• https://wordpress.org/plugins/file-uploader-for-woocommerce · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/da0f0e1a-bbf8-42a5-b330-b53134488ebd?source=cve · Note
• https://twitter.com/offseq/status/2002228392561643971 · Twitter Post
• https://twitter.com/CveFindCom/status/2002237365155209517 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002271440884695062 · Twitter Post
• https://t.me/cveNotify/146434 · Telegram Post
• https://twitter.com/0dayPublishing/status/2002222562982424699 · Twitter Post