What is the CVSS score of EUVD-2025-19288?

EUVD-2025-19288 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Drag and Drop Multiple File Upload (Pro) - WooCommerce are affected by EUVD-2025-19288?

HaruTheme's WooCommerce file upload plugin (versions 5.0.6 and earlier) contains a critical vulnerability allowing unauthenticated attackers to upload malicious executable files directly to web…

How to fix or mitigate EUVD-2025-19288?

Within 24 hours, audit all WooCommerce installations for the Drag and Drop Multiple File Upload (Pro) plugin version 5.0.6 or earlier and immediately deactivate the plugin across affected systems. Within 7 days, conduct forensic analysis of upload directories and access logs to determine if exploitation has occurred, identify any malicious files or unauthorized access, and document findings for potential incident response. Within 30 days, apply the vendor-released patch when available, implement Web Application Firewall rules to restrict uploads to approved file types only, configure the upload directory with no-execute permissions via web server settings, and perform a comprehensive security assessment of all systems that hosted the vulnerable plugin.

Drag and Drop Multiple File Upload (Pro) - WooCommerce EUVD-2025-19288

| CVE-2025-49885 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-27 audit@patchstack.com

WordPress File Upload Wordpress Plugin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated remote web-shell upload with no user interaction yields RCE; scope changes as code executes beyond the app, so full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19288

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 12:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through 5.0.6.

AnalysisAI

Unauthenticated arbitrary file upload in HaruTheme's "Drag and Drop Multiple File Upload (Pro) - WooCommerce" WordPress plugin (all versions up to and including 5.0.6) lets remote attackers upload executable PHP files (a web shell) directly to the web server, yielding full remote code execution. The flaw carries a maximum CVSS 3.1 base score of 10.0 (scope-changed, network, no privileges, no user interaction), reported by Patchstack. EPSS is low at 0.19% and there is no public exploit identified at time of analysis, but the trivial exploitability and RCE outcome make this a high-priority patch.

Technical ContextAI

The affected component is a commercial (Pro) add-on to WooCommerce/WordPress that provides a drag-and-drop multi-file upload widget, typically used to let customers attach files to orders or forms on a storefront. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin's upload handler fails to validate or restrict the type/extension/content of submitted files, so an attacker can supply a .php payload instead of an expected document or image. Because WordPress serves files from the web root under the PHP interpreter, an uploaded script placed in a web-accessible directory can then be requested and executed directly. This is a WordPress plugin issue (CPE identifiers were not provided in the input; affected product tracked as HaruTheme drag-and-drop-file-upload-wc-pro).

RemediationAI

No fixed version is stated in the provided input - every release up to and including 5.0.6 is affected and no patched version was supplied, so treat this as No vendor-released patch identified at time of analysis and check the vendor/Patchstack advisory (https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-wc-pro/vulnerability/wordpress-drag-and-drop-multiple-file-upload-pro-woocommerce-5-0-6-arbitrary-file-upload-vulnerability) for an update beyond 5.0.6 and upgrade immediately once available. Until a patched build is confirmed, the safest control is to deactivate and remove the plugin (trade-off: disables customer file-upload functionality on the store). If the feature must stay live, apply compensating controls: put a WAF/virtual-patch rule in front of the site (Patchstack and similar offer vPatches) to block the vulnerable upload endpoint; configure the web server to deny PHP/script execution in the plugin's upload directory (e.g., an .htaccess/nginx rule preventing execution of uploaded files, trade-off: only works if uploads land in a known directory); and enforce strict server-side allowlisting of permitted MIME types/extensions at the reverse proxy. Also audit upload directories for already-planted .php files and review web/server logs for suspicious POST-then-GET patterns to the upload path.