CVE-2025-6440: WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6440?
The severity of CVE-2025-6440 is considered high due to the potential for arbitrary file uploads.
How do I fix CVE-2025-6440?
To fix CVE-2025-6440, update the WooCommerce Designer Pro plugin to the latest version that addresses the issue.
What versions are affected by CVE-2025-6440?
CVE-2025-6440 affects all versions of WooCommerce Designer Pro up to and including 1.9.26.
What is the impact of CVE-2025-6440?
The impact of CVE-2025-6440 allows attackers to upload malicious files which could lead to remote code execution.
Is CVE-2025-6440 being actively exploited?
There is currently no public information indicating that CVE-2025-6440 is being actively exploited in the wild.