CVE-2025-13329

CRITICAL
2025-12-20 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Apr 08, 2026 - 19:39 vuln.today
CVE Published
Dec 20, 2025 - 04:16 nvd
CRITICAL 9.8

Tags

RCE WordPress File Upload

Description

The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.

Analysis

Unauthenticated arbitrary file upload vulnerability in File Uploader for WooCommerce (WordPress plugin versions ≤1.0.3) enables remote code execution. Missing file type validation in the 'add-image-data' REST API endpoint allows attackers to upload malicious files to Uploadcare service and retrieve them to the web server, achieving code execution without authentication. Exploitation requires no user interaction or special privileges (CVSS:3.1 AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis.

Technical Context

Root cause: insufficient input validation (CWE-434) in REST API callback function. Uploadcare integration permits upload of arbitrary file types to external service, which are then downloaded to local server filesystem. Unauthenticated access (PR:N) to vulnerable endpoint enables direct exploitation without credential requirements. Attack complexity rated low (AC:L) due to straightforward exploitation path.

Affected Products

Product: File Uploader for WooCommerce. Vendor: WordPress plugin ecosystem. Affected versions: all versions through 1.0.3 inclusive. CPE identifier not provided in available data. Platform: WordPress content management system with WooCommerce integration.

Remediation

Upstream fix available (changeset 3423070); released patched version not independently confirmed. Apply upstream security patch from WordPress plugin repository immediately. Review changeset at https://plugins.trac.wordpress.org/changeset/3423070/file-uploader-for-woocommerce/trunk/src/Helpers/class-uploaderhelper.php for implementation details. If patched version cannot be verified, deactivate plugin until vendor confirmation of release version. Implement web application firewall rules blocking unauthenticated REST API requests to 'add-image-data' endpoint as interim mitigation. Audit server filesystem for unauthorized uploads in Uploadcare integration directories. Consult Wordfence advisory for additional context: https://www.wordfence.com/threat-intel/vulnerabilities/id/da0f0e1a-bbf8-42a5-b330-b53134488ebd?source=cve

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.2
CVSS: +49
POC: 0

Share

CVE-2025-13329 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy