CVE-2025-6440
Published: 24 October 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2025-6440 is an arbitrary file upload vulnerability in the WooCommerce Designer Pro plugin for WordPress, as used by the Pricom - Printing Company & Design Services WordPress theme. The flaw arises from missing file type validation in the 'wcdp_save_canvas_design_ajax' function, affecting all versions up to and including 1.9.26. Classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact compromise.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction or privileges required. By sending crafted requests to the vulnerable AJAX endpoint, they can upload arbitrary files to the affected site's server, which may lead to remote code execution depending on server configuration and file types uploaded, such as web shells.
Advisories provide further details on mitigation, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2f8da1-7503-45e3-8a7d-0031ce264edf?source=cve and the plugin listing on Codecanyon at https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731. Practitioners should review these sources for patch availability or workarounds, such as updating to a fixed version if released or disabling the plugin.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Unauthenticated arbitrary file upload vulnerability in a public-facing WordPress plugin enables exploitation of public-facing applications (T1190) and facilitates deployment of web shells (T1100) for remote code execution.