Critical Unauthenticated Arbitrary File Upload in WooCommerce Designer Pro

CVE-2025-6440 is a critical security vulnerability affecting the WooCommerce Designer Pro plugin for WordPress, specifically in all versions up to and including 1.9.26. The vulnerability stems from the wcdp_save_canvas_design_ajax function, which fails to perform adequate file type validation during the upload process. This flaw allows an unauthenticated remote attacker to upload arbitrary files, such as malicious PHP web shells, directly to the server. Successful exploitation grants the attacker the ability to execute arbitrary code, potentially leading to a full site compromise.

The threat is significantly magnified by the public availability of automated exploitation tools. These scripts, often hosted on platforms like GitHub, support multi-threaded mass exploitation capabilities, enabling attackers to scan and compromise numerous vulnerable WordPress instances rapidly. Organizations utilizing this plugin should prioritize patching or disabling the affected functionality immediately to mitigate the risk of exploitation.

Attack Chain

1. The attacker identifies a target WordPress site utilizing the vulnerable WooCommerce Designer Pro plugin.
2. The attacker crafts a malicious request containing a webshell (typically a .php file) targeted at the wcdp_save_canvas_design_ajax endpoint.
3. The request is sent to the web server without requiring authentication.
4. The plugin's vulnerable function fails to validate the file extension or MIME type, allowing the malicious payload to be saved to the server filesystem.
5. The exploitation tool logs the exact URL path where the shell was uploaded for subsequent access.
6. The attacker sends an HTTP GET or POST request to the newly uploaded web shell file on the server.
7. The web server executes the code contained within the shell, granting the attacker remote code execution.
8. The attacker performs post-exploitation actions, such as site takeover or credential exfiltration.

Impact

Successful exploitation of CVE-2025-6440 results in complete server compromise via remote code execution. Because the vulnerability is unauthenticated and permits mass automated exploitation, it poses a severe threat to any organization using the affected plugin. Attackers can leverage this access to steal sensitive data, redirect traffic, distribute further malware, or maintain long-term persistence on the compromised WordPress infrastructure.

Recommendation

• Immediately update the WooCommerce Designer Pro plugin to the latest version beyond 1.9.26 to remediate the vulnerability.
• If an update is unavailable, disable the plugin until a patch is applied to prevent exploitation.
• Audit web server logs for suspicious POST requests to endpoints associated with the WooCommerce Designer Pro plugin, particularly those originating from unauthorized or anomalous IP addresses.
• Implement file integrity monitoring on the web root directory to detect the unauthorized creation of PHP files, which is a common indicator of web shell deployment.
• Deploy web application firewall (WAF) rules to block unauthenticated requests targeting known vulnerable plugin upload functions.