CVE-2025-13156: Vitepos WooCommerce Plugin RCE Vulnerability

CVE-2025-13156 Overview

CVE-2025-13156 is an arbitrary file upload vulnerability in the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 3.3.0. The insert_media_attachment() function lacks file type validation, and the save_update_category_img() function accepts user-supplied file types without sanitization when processing category images. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the affected server. Successful exploitation leads to remote code execution (RCE) on the underlying WordPress host.

Critical Impact
Authenticated attackers with minimal privileges can upload executable files and achieve remote code execution on the WordPress server, fully compromising confidentiality, integrity, and availability.

Affected Products

Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress
All versions up to and including 3.3.0
WordPress sites running the vulnerable plugin with Subscriber-level user registration enabled

Discovery Timeline

2025-11-21 - CVE-2025-13156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13156

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The Vitepos plugin exposes a category image upload handler that processes attachments through the insert_media_attachment() function. This function does not validate the MIME type, file extension, or magic bytes of the uploaded content. The upstream caller, save_update_category_img(), forwards user-supplied file data directly to the attachment handler without sanitization.

The authorization check on the endpoint requires only an authenticated WordPress session at the Subscriber role or higher. Subscriber is the default role for self-registered users on many WordPress sites, which substantially lowers the barrier to exploitation. Once a PHP file is written to a web-accessible path, the attacker requests it directly to execute arbitrary code under the web server user context.

Root Cause

The root cause is missing file type validation in insert_media_attachment(). The function trusts the caller-provided file extension and content type rather than enforcing an allowlist of permitted image MIME types and re-encoding image payloads. Combined with permissive role-based access on the category image upload action, this enables arbitrary file write into the WordPress uploads directory.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session at Subscriber level or higher. The attacker submits a category image update request containing a PHP payload disguised as an image. Because no extension or MIME validation occurs, the file is saved with its original extension into a web-accessible directory. The attacker then issues an HTTP GET request to the uploaded file path to trigger code execution.

The vulnerability is described in prose only, as no verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-13156

Indicators of Compromise

Unexpected .php, .phtml, or .phar files within the WordPress wp-content/uploads/ directory tree, particularly under Vitepos category image paths
POST requests to Vitepos plugin endpoints invoking save_update_category_img from low-privilege user sessions
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts shortly after a category image upload
New or modified WordPress administrator accounts created without corresponding admin-initiated activity

Detection Strategies

Monitor the WordPress uploads directory for files with executable server-side extensions and alert on creation events
Inspect web server access logs for sequences of admin-ajax.php or REST requests targeting Vitepos category image actions followed by GET requests to uploaded files
Review WordPress audit logs for Subscriber-level accounts performing media or category modifications outside expected workflows

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and the active plugin directory
Forward WordPress and web server logs to a centralized logging platform and create alerts for non-image extensions written under uploads paths
Track new user registrations and correlate Subscriber account activity with category image endpoint usage

How to Mitigate CVE-2025-13156

Immediate Actions Required

Update the Vitepos – Point of Sale (POS) for WooCommerce plugin to a version newer than 3.3.0 that includes the fix referenced in the WordPress Changeset Update
Audit the WordPress uploads directory for unexpected PHP or other server-executable files and remove any unauthorized content
Review all Subscriber and higher-privileged accounts and disable or remove unrecognized users
Rotate WordPress administrator credentials and any secrets stored in wp-config.php if compromise is suspected

Patch Information

The vendor addressed the flaw in a plugin update tracked under the WordPress plugin changeset 3398044. Site operators should upgrade the Vitepos plugin to the patched release. Verify the installed version through the WordPress plugins page after the update completes. Detailed advisory information is published in the Wordfence Vulnerability Report.

Workarounds

Disable the Vitepos plugin until the patched version can be installed if immediate updating is not feasible
Disable open user registration or restrict the default registration role to prevent untrusted users from gaining Subscriber access
Configure the web server to deny execution of PHP files inside the wp-content/uploads/ directory using an .htaccess rule or equivalent Nginx location block
Place the WordPress site behind a web application firewall with rules that block requests carrying PHP payloads to media upload endpoints

bash

# Example Apache configuration to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>