CVE-2025-4403: WordPress WooCommerce Plugin RCE Vulnerability

CVE-2025-4403 Overview

CVE-2025-4403 is a critical arbitrary file upload vulnerability affecting the Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 1.1.6 due to improper validation in the upload() function. The plugin accepts user-supplied supported_type strings and uploaded filenames without enforcing real extension or MIME type checks, allowing unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution.

Critical Impact

Unauthenticated attackers can upload malicious files, including PHP web shells, to vulnerable WordPress installations, leading to complete server compromise and remote code execution.

Affected Products

• Drag and Drop Multiple File Upload for WooCommerce plugin versions ≤ 1.1.6
• WordPress installations using vulnerable plugin versions
• WooCommerce stores with the affected plugin enabled

Discovery Timeline

• May 9, 2025 - CVE-2025-4403 published to NVD
• May 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4403

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The core issue resides in the upload() function within the class-dnd-upload-wc.php file. The plugin fails to implement proper server-side validation of uploaded files, instead relying on client-supplied values for both the file extension whitelist (supported_type) and the filename itself.

Without proper MIME type verification or extension enforcement, attackers can bypass intended file type restrictions by manipulating the HTTP request parameters. This allows the upload of executable files such as PHP scripts that can be accessed directly via the web server to execute arbitrary commands.

Root Cause

The root cause is insufficient input validation in the file upload handling mechanism. Specifically, the upload() function at line 158 and line 360 accepts user-controlled parameters without validating them against a server-side whitelist. The plugin trusts client-supplied data to determine which file types are acceptable, a fundamental security anti-pattern that violates the principle of never trusting user input.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft a malicious HTTP POST request to the vulnerable file upload endpoint with the following characteristics:

The attacker manipulates the supported_type parameter to include dangerous extensions like .php while uploading a malicious PHP file. Since the plugin performs no server-side verification of MIME types or file contents, the malicious file is saved to the uploads directory. The attacker can then access the uploaded file directly via its URL to execute arbitrary PHP code on the server, achieving remote code execution.

For technical implementation details, refer to the vulnerable code snippet and the Wordfence vulnerability analysis.

Detection Methods for CVE-2025-4403

Indicators of Compromise

• Unexpected PHP files in WordPress upload directories, particularly under /wp-content/uploads/
• Web shell files with suspicious names or obfuscated content in plugin directories
• Unusual outbound network connections from the web server
• Anomalous POST requests to plugin endpoints with manipulated supported_type parameters

Detection Strategies

• Monitor web server access logs for POST requests to /wp-admin/admin-ajax.php with actions related to the file upload plugin
• Implement file integrity monitoring on WordPress upload directories to detect unauthorized file creation
• Deploy web application firewall (WAF) rules to inspect file upload requests for dangerous extensions
• Review uploaded files for PHP code signatures or web shell patterns

Monitoring Recommendations

• Enable real-time file system monitoring on WordPress installations
• Configure alerts for new executable file creation in web-accessible directories
• Implement centralized logging of all file upload activity across WordPress sites
• Regularly audit plugin versions against vulnerability databases

How to Mitigate CVE-2025-4403

Immediate Actions Required

• Update the Drag and Drop Multiple File Upload for WooCommerce plugin to the latest patched version immediately
• Audit upload directories for suspicious files, particularly those with .php, .phtml, or other executable extensions
• Review web server access logs for evidence of exploitation attempts
• Consider temporarily disabling the plugin if immediate patching is not possible

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is documented in the WordPress plugin changeset 3289478. Users should update to the latest version available through the WordPress plugin repository. The patch implements proper server-side file type validation to prevent arbitrary file uploads.

Workarounds

• Implement web server configuration to deny execution of PHP files in upload directories using .htaccess rules
• Deploy a web application firewall with rules to block suspicious file upload attempts
• Restrict file upload functionality to authenticated users only at the web server level
• Use security plugins that provide additional file upload validation layers

# Apache .htaccess configuration to prevent PHP execution in uploads
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternative: Disable PHP execution entirely
php_flag engine off