CVE-2025-4403criticalCWE-434

CVE-2025-4403: fallo crítico en glenwpcoder Drag and Drop Multiple File Upload…

Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Drag and Drop Multiple File Upload for WooCommerce

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 9.8epss 2.3%
de la publicación al arma1 día
Publicada en NVD9 may
1ª PoC+1d
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
glenwpcoder · Drag and Drop Multiple File Upload for WooCommerce
PoCs públicas encontradas — 1
githubgithub.com/Yucaerin/CVE-2025-4403★ 3
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — glenwpcoder Drag and Drop Multiple File Upload…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2941CRITICALDrag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File MoveEPSS 1.7%