WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
82Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.
ssvc Actcvss 9.8epss 31%
de la publicación al arma6 días
Publicada en NVD24 oct
1ª PoC+6d
VulnCheck24 oct
probabilidad de explotación
31%top 2% de las CVE
explotación observada
síVulnCheck
15 exploit(s) público(s)
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
JMA Plugins · WooCommerce Designer ProPoCs públicas encontradas — 15
githubgithub.com/AnotherSec/CVE-2025-6440★ 1githubgithub.com/Nxploited/CVE-2025-6440★ 1githubgithub.com/m2hcz/CVE-2025-6440-Poc-Exploit★ 1githubgithub.com/rimbadirgantara/CVE-2025-6440★ 0githubgithub.com/0axz-tools/CVE-2025-6440★ 0githubgithub.com/BastianXploited/CVE-2025-6440★ 0githubgithub.com/sahmsec/CVE-2025-6440★ 0githubgithub.com/Cyber-DarkNay/CVE-2025-6440★ 0vulncheckvulncheck.com/xdb/39e0d8d0b983no verificadovulncheckvulncheck.com/xdb/8d451a7e1b69no verificadovulncheckvulncheck.com/xdb/db89be7c9fe9no verificadovulncheckvulncheck.com/xdb/ba8d031c8302no verificadovulncheckvulncheck.com/xdb/db877842ded3no verificadovulncheckvulncheck.com/xdb/58c4ee1d3522no verificadovulncheckvulncheck.com/xdb/1e2f9a730a13no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.