WooCommerce Designer Pro CVE-2025-6439

The only precondition is that the WooCommerce Designer Pro plugin (version 1.9.26 or earlier) is installed and active on the target WordPress site; the vulnerable 'wcdp_save_canvas_design_ajax' handler is reachable without authentication or user interaction, so default configurations of the plugin are exploitable. Exploitation is LIMITED by the plugin's niche deployment - it ships primarily via the CodeCanyon commercial listing and the Pricom printing-company theme, so the vulnerable population is narrow. The headline RCE outcome is not a single-shot result: achieving code execution requires the follow-on step of hijacking the WordPress reinstallation after a critical file (e.g. wp-config.php) is deleted, whereas data loss and site unavailability follow directly from the deletion primitive.

All signals converge on genuine high severity for exposed instances. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description's claim of unauthenticated remote exploitation, and CWE-22 path traversal enabling arbitrary file deletion is a well-understood, reliable primitive. However, the signals are NOT uniform: exploitation likelihood is far lower than the 9.8 base score alone suggests. EPSS is only 0.81% (56th percentile), the CVE is NOT in CISA KEV, and no POC is referenced in the provided data - so this is a high-CVSS flaw without confirmed real-world weaponization. The C:H rating in the vector is attributable to the documented file-deletion-to-RCE chain (deleting wp-config.php forces a WordPress reinstall an attacker can hijack) rather than any direct data-disclosure primitive; direct impact is better described as integrity (deletion) and availability (site unavailability). Net: a real priority to patch for the subset of sites running this specific commercial plugin, but the low EPSS and absence of KEV/POC suggest it is not currently under mass exploitation. The RCE outcome is a documented potential consequence, not a verified capability in the provided intelligence.

An unauthenticated attacker sends a crafted AJAX request to the 'wcdp_save_canvas_design_ajax' endpoint on a site running WooCommerce Designer Pro ≤1.9.26, supplying a traversal file path that causes the plugin to delete files outside the intended directory. By deleting wp-config.php, the attacker can force WordPress into its initial setup flow and hijack the reinstallation to point at an attacker-controlled database, escalating to remote code execution. No POC is referenced in the provided data, and the low AC with no required privileges or user interaction makes exploitation technically straightforward against vulnerable installs.