Skip to content
OpenAdvisories
Critical · 10.0 CVE-2025-49885 EUVD-2025-19288GHSA-gv3g-5wrh-3x24

WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability

Published Jun 27, 2025 · Updated May 12, 2026 · Assigned by Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.

Affected products

VendorProductAffectedFixed
HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce ≤ 5.0.6 —

References