EUVD-2025-17622CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
Analysis
The Abandoned Cart Pro for WooCommerce plugin (versions ≤9.16.0) contains an authenticated arbitrary file upload vulnerability in the wcap_add_to_cart_popup_upload_files function that lacks file type validation. Authenticated attackers with subscriber-level privileges can upload arbitrary files to the server, potentially enabling remote code execution depending on server configuration. This is a high-severity vulnerability (CVSS 8.8) affecting WooCommerce e-commerce sites; exploitation requires valid user credentials but no user interaction.
Technical Context
The vulnerability exists in the Abandoned Cart Pro plugin for WooCommerce, a popular e-commerce cart recovery solution. The vulnerable function wcap_add_to_cart_popup_upload_files fails to implement proper file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing bypass of upload restrictions. WooCommerce plugins operate within the WordPress application framework and execute server-side PHP code. The lack of whitelist-based file extension/MIME-type validation combined with predictable upload directories enables attackers to place malicious PHP files (.php, .phtml, .php5, etc.) or other executable content that the web server will interpret and execute. This is particularly dangerous in WordPress environments where plugins have broad file system access.
Affected Products
Abandoned Cart Pro for WooCommerce plugin, versions 0.0.0 through 9.16.0 (inclusive). Affected installations: any WordPress site with WooCommerce and this plugin installed with vulnerable version. CPE would be: cpe:2.3:a:abandoned_cart_pro:abandoned_cart_pro:*:*:*:*:*:woocommerce:*:* (versions <9.16.0). Vulnerability affects multi-user WooCommerce sites most critically, as subscriber-level access is the attack vector. Sites allowing user registration or with existing user bases are at highest risk.
Remediation
Immediate actions: (1) Update Abandoned Cart Pro for WooCommerce to version 9.16.1 or later (patch version should address file type validation). (2) If immediate update not possible, disable the cart popup upload feature or restrict subscriber role permissions to upload files via WordPress role management. (3) Implement Web Application Firewall (WAF) rules to block uploads of executable file types (.php, .phtml, .php3, .php4, .php5, .phtml, .phps, .pht, .phpt, .pgif, .shtml, .htaccess, .phar, .inc). (4) Review upload directory permissions: ensure WordPress uploads directory is not executable by web server (set permissions to 644 for files, 755 for directories, and add .htaccess with 'deny from all' in sensitive directories). (5) Audit recent file uploads via WordPress admin or server logs to detect prior exploitation. (6) Review subscriber/user accounts for suspicious activity. Reference vendor advisory from Abandoned Cart Pro security page or WooCommerce.com plugin repository for official patch details.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today