CVE-2025-2941criticalCWE-22

CVE-2025-2941: critical vulnerability in glenwpcoder Drag and Drop Multiple File Upload…

Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move

Published · Updated

Follow this CVE+ Monitor Drag and Drop Multiple File Upload for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.7%
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
glenwpcoder · Drag and Drop Multiple File Upload for WooCommerce
Related CVEs — glenwpcoder Drag and Drop Multiple File Upload…

In the same product, most dangerous first.

CVE-2025-4403CRITICALDrag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload FunctionEPSS 2.3%