CVE-2025-29009

CVE-2025-29009 is an unauthenticated arbitrary file upload vulnerability affecting the Webkul Medical Prescription Attachment Plugin for WooCommerce, a WordPress plugin, in all versions up to and including 1.2.3. The vulnerability is caused by a lack of server-side validation for file extensions or MIME types within the plugin's `wkwcpa_handle_prescription_session` AJAX handler. Because the handler accepts file uploads via the `wkwc_pa_prescription_attachment[]` parameter without verifying the file type, it allows users to upload arbitrary files to the server. To exploit this vulnerability, an unauthenticated attacker can retrieve the necessary `ajaxNonce` from the public WooCommerce storefront, where it is embedded in the `wkwcpaFrontObj` JavaScript object. Using this nonce, the attacker can upload a PHP web shell directly to the server's uploads directory. The plugin's response returns the full, accessible URL of the uploaded file, enabling the attacker to execute remote code on the affected site's server.