CVE-2025-2941: WooCommerce File Upload Plugin RCE Flaw

CVE-2025-2941 Overview

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress contains a critical arbitrary file moving vulnerability caused by insufficient file path validation in the wc-upload-file[] parameter. All versions up to and including 1.1.4 are affected. This vulnerability allows unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are moved.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to move critical WordPress configuration files, potentially leading to complete site compromise and remote code execution.

Affected Products

• Drag and Drop Multiple File Upload for WooCommerce plugin versions up to and including 1.1.4
• WordPress installations running the vulnerable plugin
• WooCommerce sites with the affected file upload functionality

Discovery Timeline

• April 5, 2025 - CVE-2025-2941 published to NVD
• April 7, 2025 - Last updated in NVD database

Technical Details for CVE-2025-2941

Vulnerability Analysis

This vulnerability falls under CWE-22 (Path Traversal) and represents a critical security flaw in the file upload handling mechanism of the Drag and Drop Multiple File Upload for WooCommerce plugin. The vulnerability exists because the plugin fails to properly validate and sanitize file paths submitted through the wc-upload-file[] parameter.

When processing file upload requests, the plugin does not adequately verify that the destination path remains within the intended upload directory. Attackers can supply path traversal sequences (such as ../) in the file path parameter to manipulate where files are moved on the server filesystem.

The most dangerous exploitation scenario involves moving the wp-config.php file, which contains database credentials and authentication keys. By relocating this file to a web-accessible location or removing it from its expected location, attackers can either expose sensitive credentials or cause the WordPress installation to enter setup mode, allowing complete takeover.

Root Cause

The root cause of this vulnerability is insufficient input validation on the wc-upload-file[] parameter. The plugin accepts user-controlled file paths without properly sanitizing directory traversal sequences or validating that the target path remains within allowed boundaries. This allows attackers to escape the intended upload directory and access or manipulate files anywhere on the filesystem that the web server process has permissions to access.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable endpoint, supplying path traversal sequences in the wc-upload-file[] parameter. Since no authentication is required, any remote attacker with network access to the vulnerable WordPress site can exploit this vulnerability.

The exploitation process typically involves:

1. Identifying a WordPress site running the vulnerable plugin version
2. Crafting a malicious request with path traversal sequences in the file parameter
3. Moving critical configuration files to expose credentials or trigger site misconfiguration
4. Leveraging the exposed information or misconfiguration for further exploitation, potentially achieving remote code execution

Detection Methods for CVE-2025-2941

Indicators of Compromise

• Unexpected HTTP requests to WooCommerce file upload endpoints containing path traversal patterns (../, ..%2f, or URL-encoded variants)
• Missing or relocated wp-config.php or other critical WordPress configuration files
• Web server error logs showing file access attempts outside the expected upload directory
• Unusual file system activity in the WordPress root directory or parent directories
• WordPress installation unexpectedly entering setup/installation mode

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal sequences in request parameters
• Monitor web server access logs for requests containing wc-upload-file[] parameters with suspicious path patterns
• Deploy file integrity monitoring (FIM) on critical WordPress files including wp-config.php, .htaccess, and core WordPress files
• Configure intrusion detection systems to alert on anomalous file operations by the web server process

Monitoring Recommendations

• Enable verbose logging on WordPress file upload operations to capture detailed request information
• Set up real-time alerts for any modification, deletion, or relocation of wp-config.php
• Monitor web server process file access patterns for operations outside the WordPress uploads directory
• Regularly audit installed plugin versions against known vulnerability databases

How to Mitigate CVE-2025-2941

Immediate Actions Required

• Update the Drag and Drop Multiple File Upload for WooCommerce plugin to the latest patched version immediately
• Audit WordPress installations to verify wp-config.php and other critical files are intact and in their expected locations
• Review web server access logs for evidence of exploitation attempts
• Consider temporarily disabling the plugin until the update can be applied if immediate updating is not possible

Patch Information

A security patch has been released to address this vulnerability. Administrators should update to the latest version of the Drag and Drop Multiple File Upload for WooCommerce plugin as documented in the WordPress Plugin Changeset. Additional information is available from the Wordfence Vulnerability Report and the WordPress Plugin Developer Info page.

Workarounds

• Temporarily disable the Drag and Drop Multiple File Upload for WooCommerce plugin if immediate patching is not feasible
• Implement server-level restrictions to block path traversal patterns in HTTP requests using .htaccess rules or WAF policies
• Apply filesystem permissions to prevent the web server process from modifying files outside the WordPress uploads directory
• Consider using a reverse proxy with request filtering capabilities to sanitize incoming requests

# Example .htaccess rule to block path traversal patterns
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f) [NC,OR]
RewriteCond %{REQUEST_URI} (\.\./|\.\.%2f) [NC]
RewriteRule .* - [F,L]