CVE-2025-13329: 
WordPress vulnerability analysis and mitigation

CVE-2025-13329 is a critical arbitrary file upload vulnerability in the File Uploader for WooCommerce plugin for WordPress, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in all versions up to and including 1.0.3 and allows unauthenticated attackers to upload arbitrary files via the add-image-data REST API endpoint, potentially enabling remote code execution (RCE). It was published on December 20, 2025, and assigned a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is missing file type validation in the callback function handling the add-image-data REST API endpoint (CWE-434). An unauthenticated attacker can send a crafted HTTP request to this endpoint, uploading an arbitrary file (e.g., a PHP web shell) to the Uploadcare third-party service. The plugin then downloads the uploaded file back to the affected WordPress server, making the malicious file accessible and potentially executable. No authentication or user interaction is required, and attack complexity is low, making this trivially exploitable over the network (Wordfence, ENISA EUVD).

Successful exploitation can result in complete compromise of the affected WordPress site, including full confidentiality, integrity, and availability impact. An attacker can upload and execute arbitrary code (e.g., PHP web shells or backdoors), gain persistent unauthorized access, exfiltrate sensitive site data, install malware, and potentially pivot to other systems on the same hosting infrastructure. The unauthenticated nature of the attack means any internet-exposed WordPress site running the vulnerable plugin is at risk without any user interaction (Wordfence, The Hacker Wire).

As of the time of reporting, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA did reference it in a weekly vulnerability bulletin (CISA Bulletin). The EPSS score is approximately 0.197%, indicating a currently low but non-negligible probability of exploitation in the near term. A Nuclei detection template pull request has been submitted to the ProjectDiscovery repository, which may lower the barrier for automated scanning (Nuclei Templates PR).

1. Reconnaissance: Identify WordPress sites running the File Uploader for WooCommerce plugin (versions ≤ 1.0.3) using tools like WPScan, Shodan, or Censys by fingerprinting the plugin's presence via known file paths (e.g., /wp-content/plugins/file-uploader-for-woocommerce/).
2. Identify the vulnerable endpoint: Locate the unauthenticated REST API endpoint — add-image-data — exposed by the plugin, typically accessible at /wp-json/<namespace>/add-image-data.
3. Craft malicious upload request: Prepare a PHP web shell file (e.g., shell.php) and send an unauthenticated HTTP POST request to the add-image-data endpoint, supplying the malicious file as the image data payload without any file type restriction being enforced.
4. File uploaded to Uploadcare: The plugin uploads the attacker-supplied file to the Uploadcare CDN service without validating the file type.
5. Trigger server-side download: The plugin's callback mechanism downloads the uploaded file from Uploadcare back to the WordPress server's file system, placing the malicious file in a web-accessible directory.
6. Execute remote code: Access the uploaded web shell via its URL on the target server (e.g., https://target.com/wp-content/uploads/shell.php) to execute arbitrary OS commands, establish a reverse shell, or perform further post-exploitation activities (Wordfence, The Hacker Wire).

• Network: Unexpected outbound connections from the WordPress server to Uploadcare CDN domains (e.g., ucarecdn.com) not initiated by legitimate user activity; unusual inbound POST requests to /wp-json/*/add-image-data from unknown or automated IP addresses.
• File System: Presence of unexpected PHP files (e.g., shell.php, cmd.php) in WordPress upload directories (/wp-content/uploads/) or plugin directories; files with recently modified timestamps inconsistent with normal site activity.
• Logs: WordPress/web server access logs showing POST requests to the add-image-data REST API endpoint from unauthenticated sources; HTTP requests to newly created PHP files in upload directories returning 200 responses.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM) such as bash, curl, wget, or python; unexpected cron jobs or scheduled tasks added to the server.

The primary remediation is to update the File Uploader for WooCommerce plugin to a version beyond 1.0.3, which includes proper file type validation (Wordfence). If an immediate update is not possible, disable the plugin to eliminate the attack surface. Additional mitigations include deploying a Web Application Firewall (WAF) to filter malicious upload requests, restricting access to REST API endpoints where feasible, and monitoring server logs for suspicious upload activity. A thorough post-incident audit of the WordPress site's file system is recommended for any site that ran the vulnerable version.

The vulnerability was reported by Wordfence, which assigned it a critical severity rating and published details in its threat intelligence database (Wordfence). The Hacker Wire covered it as a notable critical RCE risk for WooCommerce-based WordPress sites (The Hacker Wire). CISA included it in its weekly vulnerability bulletin for the week of December 15, 2025 (CISA Bulletin). Community discussion was noted on Mastodon/Infosec.exchange and Bluesky, with security researchers flagging the unauthenticated RCE potential as particularly concerning.