CVE-2025-11391

Published Oct 18, 2025

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-11391 is an arbitrary file upload vulnerability found in the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress. This flaw, discovered in October 2025, stems from a lack of file type validation within the plugin's image cropper functionality. The vulnerability allows unauthenticated attackers to bypass file type restrictions and upload arbitrary files to the affected website's server. This could potentially lead to remote code execution on the compromised system. The issue impacts all versions of the plugin up to and including 33.0.15, specifically affecting users who have the paid version of the software installed and activated, despite the vulnerable code being present in the free version. A fix for this vulnerability was released in version 33.0.16 of the plugin on October 16, 2025.

Description: The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-434

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 3

References