CVE-2025-2941: Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move
First published: Sat Apr 05 2025(Updated: )
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WooCommerce Drag and Drop Multiple File Upload for WooCommerce | <=1.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2685a2b4-aba3-425b-af0d-06f7693ab3d7?source=cve
- https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&new=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2025-2941?
CVE-2025-2941 is rated as a high severity vulnerability due to its potential for arbitrary file movement.
How do I fix CVE-2025-2941?
To fix CVE-2025-2941, update the Drag and Drop Multiple File Upload for WooCommerce plugin to version 1.1.5 or later.
Who is affected by CVE-2025-2941?
Any user of the Drag and Drop Multiple File Upload for WooCommerce plugin in versions up to and including 1.1.4 is affected by CVE-2025-2941.
What type of vulnerability is CVE-2025-2941?
CVE-2025-2941 is an arbitrary file moving vulnerability resulting from insufficient file path validation.
Can CVE-2025-2941 be exploited by unauthenticated users?
Yes, CVE-2025-2941 can be exploited by unauthenticated users, making it a severe security risk.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/last-modified-date
- agent/event
- vendor/woocommerce
- canonical/woocommerce drag and drop multiple file upload for woocommerce