CVE-2025-6440criticalobserved exploitationCWE-434

CVE-2025-6440: critical vulnerability in JMA Plugins WooCommerce Designer Pro

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor WooCommerce Designer Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 33%
from disclosure to weapon6 days
Published on NVDOct 24
1st PoC+6d
VulnCheckOct 24
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
JMA Plugins · WooCommerce Designer Pro
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — JMA Plugins WooCommerce Designer Pro

In the same product, most dangerous first.

CVE-2025-10897HIGHWooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File ReadEPSS 1.9%CVE-2025-6439CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File DeletionEPSS 0.8%