Unauthenticated Arbitrary File Upload in Drag and Drop Multiple File Upload for WooCommerce

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress (versions 1.1.6 and below) is susceptible to an unauthenticated arbitrary file upload vulnerability identified as CVE-2025-4403. The vulnerability stems from the plugin's upload() function, which fails to adequately validate the supported_type parameter or the file extension of uploaded files. By manipulating these parameters, unauthenticated remote attackers can bypass intended restrictions to upload malicious files, such as web shells, directly to the web server. Successful exploitation allows for full remote code execution (RCE) on the WordPress instance. Given the availability of public exploit scripts, the risk of exploitation is elevated for internet-facing installations.

Impact

The vulnerability carries a CVSS score of 9.8. Successful exploitation leads to full system compromise, allowing an attacker to execute arbitrary code, modify site content, exfiltrate sensitive data from the WordPress database, or leverage the compromised server to conduct further attacks.

Recommendation

• Update the "Drag and Drop Multiple File Upload for WooCommerce" plugin to a version patched against CVE-2025-4403 immediately.
• If a patch is unavailable or cannot be applied, disable the plugin until a secure version is installed.
• Implement file integrity monitoring to detect the creation of unexpected files within the WordPress uploads directory.
• Configure web server rules to deny execution of scripts (e.g., .php files) within the upload storage directory.