CVE-2025-11391: WooCommerce PPOM Plugin RCE Vulnerability

CVE-2025-11391 Overview

CVE-2025-11391 is a critical arbitrary file upload vulnerability affecting the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress. The vulnerability exists due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This flaw enables unauthenticated attackers to upload arbitrary files on the affected site's server, potentially leading to remote code execution.

While the vulnerable code is present in the free version of the plugin, exploitation requires that users have the paid version of the software installed and activated. This distinction is important for accurately assessing exposure within WordPress environments utilizing WooCommerce.

Critical Impact

Unauthenticated attackers can upload malicious files (including PHP webshells) to compromise WordPress servers, enabling full remote code execution without any authentication requirements.

Affected Products

• PPOM – Product Addons & Custom Fields for WooCommerce plugin versions up to and including 33.0.15
• WordPress sites running the paid version of the PPOM plugin
• WooCommerce-enabled WordPress installations with the affected plugin active

Discovery Timeline

• 2025-10-18 - CVE-2025-11391 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-11391

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The core issue stems from the image cropper functionality within the PPOM plugin failing to properly validate uploaded file types before processing them. The vulnerability is accessible over the network without requiring any authentication, making it particularly dangerous for public-facing WordPress sites.

The lack of file type validation means attackers can bypass intended restrictions and upload executable files such as PHP scripts. Once uploaded, these malicious files can be accessed directly through the web server, enabling attackers to execute arbitrary code with the privileges of the web server process. This can lead to complete site compromise, data theft, defacement, or use of the server in further attacks.

Root Cause

The root cause is the absence of proper file type validation in the image cropper functionality located in the plugin's hooks.php file. The code processes uploaded files without verifying that they are legitimate image files, allowing any file type—including executable PHP files—to be uploaded to the server. Proper validation should include checks for file extensions, MIME types, and file content (magic bytes) to ensure only expected image formats are accepted.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated user. An attacker would craft a malicious request to the image cropper endpoint, submitting a PHP webshell or other malicious file disguised or presented as an image upload. Due to the missing validation:

1. The attacker identifies a WordPress site running the vulnerable paid version of PPOM plugin
2. The attacker crafts a multipart form request targeting the image cropper functionality
3. Instead of a legitimate image, the attacker includes a PHP file containing malicious code
4. The server accepts and stores the file without validation
5. The attacker accesses the uploaded file directly via its URL, executing the malicious PHP code
6. The attacker gains remote code execution capabilities on the target server

For technical details on the vulnerable code path, refer to the WordPress WooCommerce Hook Source.

Detection Methods for CVE-2025-11391

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories, particularly those associated with the PPOM plugin
• Suspicious HTTP POST requests to PPOM plugin endpoints containing non-image file content
• Web server logs showing access to unfamiliar PHP files in plugin or upload directories
• Anomalous outbound network connections from the WordPress server indicating webshell activity

Detection Strategies

• Implement file integrity monitoring on WordPress installations to detect unauthorized file additions
• Configure web application firewalls (WAF) to inspect file uploads and block requests containing PHP code in image upload fields
• Review web server access logs for unusual POST requests to /wp-content/plugins/woocommerce-product-addon/ paths
• Deploy endpoint detection solutions capable of identifying webshell artifacts and behaviors

Monitoring Recommendations

• Enable detailed logging for the WordPress uploads directory and plugin directories
• Monitor for process execution chains originating from the web server process (e.g., Apache/Nginx spawning shell commands)
• Set up alerts for new PHP file creation in directories that should only contain media files
• Implement network monitoring for command-and-control traffic patterns typically associated with webshell activity

How to Mitigate CVE-2025-11391

Immediate Actions Required

• Update the PPOM – Product Addons & Custom Fields for WooCommerce plugin to a patched version immediately
• Audit WordPress upload directories for any suspicious or unexpected PHP files
• Review web server logs for evidence of exploitation attempts targeting the image cropper functionality
• If compromise is suspected, perform a full security assessment and restore from known-good backups

Patch Information

A security patch addressing this vulnerability is available. Administrators should update to the latest version of the PPOM plugin beyond 33.0.15. The fix can be reviewed in the WordPress Code Changeset. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable the PPOM plugin until an update can be applied
• Implement server-level restrictions to block PHP execution in upload directories using .htaccess or nginx configuration
• Configure a web application firewall to block file upload requests containing executable content
• Restrict access to the WordPress admin and plugin directories to trusted IP addresses where feasible

# Apache: Prevent PHP execution in uploads directory
# Add to .htaccess in wp-content/uploads/
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>