CVE-2025-10897highobserved exploitationCWE-22

CVE-2025-10897: high-severity vulnerability in JMA Plugins WooCommerce Designer Pro

WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read

Published · Updated

Follow this CVE+ Monitor WooCommerce Designer Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.6epss 1.9%
from disclosure to weapon274 days
Published on NVDOct 31
1st PoC+274d
VulnCheck+347d
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
JMA Plugins · WooCommerce Designer Pro
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — JMA Plugins WooCommerce Designer Pro

In the same product, most dangerous first.

CVE-2025-6440CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File UploadEPSS 33.3%CVE-2025-6439CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File DeletionEPSS 0.8%