CVE-2025-13156
Published: 21 November 2025
Description
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to…
more
the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of user-supplied inputs like file types during category image uploads to prevent arbitrary file uploads.
Mandates timely remediation of flaws such as missing file validation through patching the affected plugin versions.
Implements malicious code protection at system entry points to scan and block dangerous files uploaded via the vulnerable function.
Security SummaryAI
CVE-2025-13156 is an arbitrary file upload vulnerability in the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress, affecting all versions up to and including 3.3.0. The issue stems from missing file type validation in the insert_media_attachment() function, exploited via the save_update_category_img() function, which accepts user-supplied file types without validation during category image processing.
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows uploading arbitrary files to the affected site's server, enabling remote code execution. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Mitigation is provided through a patch in WordPress plugins trac changeset 3398044. Further details on the vulnerability and remediation are available in the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin allows authenticated remote code execution, directly enabling exploitation of a public-facing application.