WordPress CVE-2025-13329
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
AnalysisAI
Unauthenticated arbitrary file upload vulnerability in File Uploader for WooCommerce (WordPress plugin versions ≤1.0.3) enables remote code execution. Missing file type validation in the 'add-image-data' REST API endpoint allows attackers to upload malicious files to Uploadcare service and retrieve them to the web server, achieving code execution without authentication. Exploitation requires no user interaction or special privileges (CVSS:3.1 AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis.
Technical ContextAI
Root cause: insufficient input validation (CWE-434) in REST API callback function. Uploadcare integration permits upload of arbitrary file types to external service, which are then downloaded to local server filesystem. Unauthenticated access (PR:N) to vulnerable endpoint enables direct exploitation without credential requirements. Attack complexity rated low (AC:L) due to straightforward exploitation path.
Affected ProductsAI
Product: File Uploader for WooCommerce. Vendor: WordPress plugin ecosystem. Affected versions: all versions through 1.0.3 inclusive. CPE identifier not provided in available data. Platform: WordPress content management system with WooCommerce integration.
RemediationAI
Upstream fix available (changeset 3423070); released patched version not independently confirmed. Apply upstream security patch from WordPress plugin repository immediately. Review changeset at https://plugins.trac.wordpress.org/changeset/3423070/file-uploader-for-woocommerce/trunk/src/Helpers/class-uploaderhelper.php for implementation details. If patched version cannot be verified, deactivate plugin until vendor confirmation of release version. Implement web application firewall rules blocking unauthenticated REST API requests to 'add-image-data' endpoint as interim mitigation. Audit server filesystem for unauthorized uploads in Uploadcare integration directories. Consult Wordfence advisory for additional context: https://www.wordfence.com/threat-intel/vulnerabilities/id/da0f0e1a-bbf8-42a5-b330-b53134488ebd?source=cve
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Remote code execution in the WPCode WordPress plugin (versions through 2.3.5) lets authenticated author-level users run
Share
External POC / Exploit Code
Leaving vuln.today