CVE-2025-49885: WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through 5.0.6.
Other sources
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49885?
CVE-2025-49885 is considered a critical vulnerability due to the potential for unrestricted file uploads leading to remote code execution.
How do I fix CVE-2025-49885?
To fix CVE-2025-49885, update the HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin to version 5.0.7 or later.
What versions are affected by CVE-2025-49885?
CVE-2025-49885 affects versions of HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce from n/a to 5.0.6.
What types of attacks can CVE-2025-49885 enable?
CVE-2025-49885 can enable attacks such as uploading web shells to the web server, which can lead to unauthorized access and control.
Who is the vendor of the affected software for CVE-2025-49885?
The vendor of the affected software for CVE-2025-49885 is HaruTheme.