What is the CVSS score of CVE-2025-4387?

CVE-2025-4387 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-4387?

An authenticated file upload vulnerability in the Abandoned Cart Pro for WooCommerce plugin (versions up to 9.16.0) allows users with subscriber-level access to upload malicious files that could lead…

How to fix or mitigate CVE-2025-4387?

Within 24 hours: Audit user roles and subscriber-level accounts for suspicious activity; disable the plugin if not actively used for business-critical functions. Within 7 days: Engage WooCommerce plugin vendor for security patch status and timeline; review file upload directories for unauthorized files; implement Web Application Firewall rules to restrict file uploads. Within 30 days: Obtain patched version once available and apply immediately; conduct comprehensive code review of uploaded files; implement file upload restrictions at the application and server level.

PHP CVE-2025-4387

EUVD-2025-17622 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-10 security@wordfence.com

WordPress File Upload RCE PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17622

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.

AnalysisAI

The Abandoned Cart Pro for WooCommerce plugin (versions ≤9.16.0) contains an authenticated arbitrary file upload vulnerability in the wcap_add_to_cart_popup_upload_files function that lacks file type validation. Authenticated attackers with subscriber-level privileges can upload arbitrary files to the server, potentially enabling remote code execution depending on server configuration. This is a high-severity vulnerability (CVSS 8.8) affecting WooCommerce e-commerce sites; exploitation requires valid user credentials but no user interaction.

Technical ContextAI

The vulnerability exists in the Abandoned Cart Pro plugin for WooCommerce, a popular e-commerce cart recovery solution. The vulnerable function wcap_add_to_cart_popup_upload_files fails to implement proper file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing bypass of upload restrictions. WooCommerce plugins operate within the WordPress application framework and execute server-side PHP code. The lack of whitelist-based file extension/MIME-type validation combined with predictable upload directories enables attackers to place malicious PHP files (.php, .phtml, .php5, etc.) or other executable content that the web server will interpret and execute. This is particularly dangerous in WordPress environments where plugins have broad file system access.

RemediationAI

Immediate actions: (1) Update Abandoned Cart Pro for WooCommerce to version 9.16.1 or later (patch version should address file type validation). (2) If immediate update not possible, disable the cart popup upload feature or restrict subscriber role permissions to upload files via WordPress role management. (3) Implement Web Application Firewall (WAF) rules to block uploads of executable file types (.php, .phtml, .php3, .php4, .php5, .phtml, .phps, .pht, .phpt, .pgif, .shtml, .htaccess, .phar, .inc). (4) Review upload directory permissions: ensure WordPress uploads directory is not executable by web server (set permissions to 644 for files, 755 for directories, and add .htaccess with 'deny from all' in sensitive directories). (5) Audit recent file uploads via WordPress admin or server logs to detect prior exploitation. (6) Review subscriber/user accounts for suspicious activity. Reference vendor advisory from Abandoned Cart Pro security page or WooCommerce.com plugin repository for official patch details.