Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-4403 EUVD-2025-14168GHSA-hm24-j3c3-fqqm

Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

Published May 9, 2025 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: glenwpcoder Product: Drag and Drop Multiple File Upload for WooCommerce Category: Web / CMS

Description

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

VendorProductAffectedFixed
glenwpcoder Drag and Drop Multiple File Upload for WooCommerce ≤ 1.1.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Yucaerin/CVE-2025-4403 ★ 3 · May 10, 2025

    Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References