CVE-2025-10412: 
WordPress vulnerability analysis and mitigation

CVE-2025-10412 is a critical arbitrary file upload vulnerability in the Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress. It stems from misconfigured file type validation in the uni_cpo_upload_file function, allowing unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. All plugin versions up to and including 4.9.55 are affected. The vulnerability was published on September 23, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The uni_cpo_upload_file function in the Uni CPO Premium plugin fails to properly validate or restrict the types of files that can be uploaded, allowing any file extension — including server-executable scripts such as PHP webshells — to be submitted without authentication. Because no privilege check or authentication gate is enforced before the upload handler is invoked, a remote attacker can send a crafted HTTP request directly to the vulnerable endpoint and place a malicious file on the web server's filesystem. No user interaction or special privileges are required, making this a network-accessible, low-complexity attack (Wordfence, ZeroPath).

Successful exploitation allows an unauthenticated attacker to upload arbitrary files — including PHP webshells — to the WordPress server, which can lead to full remote code execution under the web server's process context. This enables complete compromise of the affected WordPress site, including theft of sensitive data (database credentials, user PII, payment information stored via WooCommerce), defacement, installation of backdoors, and potential lateral movement to other systems on the same hosting environment. The CVSS score reflects high impact across confidentiality, integrity, and availability (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Uni CPO (Premium) plugin (versions ≤ 4.9.55) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/uni-cpo/) on target sites.
2. Locate the vulnerable endpoint: Identify the AJAX action or REST endpoint that invokes the uni_cpo_upload_file function. This is typically accessible without authentication via WordPress's admin-ajax.php or a registered REST route.
3. Craft a malicious upload request: Prepare a PHP webshell file (e.g., shell.php) and craft an HTTP POST request to the upload endpoint, bypassing any client-side restrictions. The misconfigured server-side validation will not block the .php extension.
4. Upload the webshell: Submit the crafted multipart/form-data POST request to the target endpoint. If successful, the server returns a path or URL to the uploaded file.
5. Achieve remote code execution: Access the uploaded webshell via its URL (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands on the server.
6. Establish persistence: Use the webshell to install a reverse shell, create a backdoor admin account, or exfiltrate database credentials from wp-config.php (Wordfence, ZeroPath).

• Network: Unexpected HTTP POST requests to admin-ajax.php or plugin-specific REST endpoints with multipart file upload payloads from unauthenticated sources; outbound connections from the web server process to unknown external IPs.
• File System: Presence of .php, .phtml, .phar, or other executable script files in WordPress upload directories (e.g., /wp-content/uploads/) or plugin directories; newly created files with webshell signatures (e.g., eval(, base64_decode(, system(, passthru().
• Logs: Web server access logs showing POST requests to the Uni CPO upload handler from unexpected IPs, followed by GET requests to newly created files in upload directories; PHP error logs referencing unexpected file execution paths.
• Process: Unusual child processes spawned by the web server (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python; unexpected outbound network connections initiated by the web server process.

Update the Uni CPO (Premium) plugin to a version beyond 4.9.55 that addresses the file type validation flaw — contact the vendor (MooMoo / Builderius) or check the plugin's official update channel for the patched release (Wordfence, Builderius). If an immediate update is not possible, temporarily disable the plugin to eliminate the attack surface. As additional hardening measures: deploy a Web Application Firewall (WAF) with rules to block suspicious file uploads (e.g., Wordfence, Cloudflare WAF); configure the web server to deny execution of scripts in the WordPress uploads directory (e.g., via .htaccess or Nginx location blocks); and audit existing upload directories for any previously placed malicious files.

Wordfence, which discovered and disclosed the vulnerability, published it in their threat intelligence database and included it in their weekly WordPress vulnerability report for the week of September 22–28, 2025 (Wordfence Weekly Report). The vulnerability was also picked up by CISA's weekly vulnerability bulletin and noted by Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT (CISA Bulletin, INCIBE). Community aggregators including VulDB, Vulners, and CIRCL's vulnerability lookup service indexed the CVE shortly after publication, reflecting standard tracking activity without notable controversy or debate.