CVE-2025-49885: 
WordPress vulnerability analysis and mitigation

CVE-2025-49885 is an Unrestricted File Upload vulnerability (CWE-434) in the HaruTheme "Drag and Drop Multiple File Upload (Pro) - WooCommerce" WordPress plugin that allows unauthenticated attackers to upload arbitrary files, including web shells, to the web server. It affects all plugin versions up to and including 5.0.6, with version 5.0.7 being the patched release. The vulnerability was reported by researcher "Bonds" on May 11, 2025, and published by Patchstack on June 23, 2025. It carries a CVSS v3.1 base score of 10.0 (Critical) (Patchstack, Red Hat CVE).

The root cause is improper or absent validation of uploaded file types (CWE-434), allowing any file — including PHP web shells — to be uploaded through the plugin's drag-and-drop file upload functionality intended for WooCommerce order attachments. Because no authentication is required and no file type restrictions are enforced, a remote attacker can submit a crafted multipart HTTP POST request containing a malicious PHP file directly to the vulnerable upload endpoint. The vulnerability is classified under OWASP Top 10 A3: Injection and is mapped to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs) (Patchstack).

Successful exploitation grants an unauthenticated attacker the ability to upload and execute arbitrary PHP code on the server, resulting in full compromise of the WordPress site and potentially the underlying host. This enables complete loss of confidentiality (access to all site data, credentials, and database contents), integrity (modification or deletion of files and data), and availability (server disruption or ransomware deployment). The compromised server can also be leveraged as a pivot point for further attacks against internal networks or used in mass-exploit campaigns targeting other sites (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially exploitable at scale if a PoC becomes public. Patchstack notes that vulnerabilities of this class (CVSS 10, unauthenticated arbitrary file upload) are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously. The EPSS score is 0.00043, reflecting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Drag and Drop Multiple File Upload (Pro) - WooCommerce" plugin version ≤ 5.0.6 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/drag-and-drop-file-upload-wc-pro/readme.txt.
2. Locate the upload endpoint: Identify the plugin's unauthenticated file upload endpoint, typically exposed via a WooCommerce AJAX action or a dedicated upload handler within the plugin.
3. Craft malicious payload: Prepare a PHP web shell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?> or a more feature-rich shell.
4. Upload the web shell: Send a crafted multipart HTTP POST request to the vulnerable upload endpoint without any authentication credentials, attaching the PHP web shell as the uploaded file.
5. Locate the uploaded file: Determine the upload directory path (commonly within wp-content/uploads/ or a plugin-specific subdirectory) by observing the server's response or through directory enumeration.
6. Execute arbitrary commands: Access the uploaded shell via a browser or curl (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands and achieve full server compromise (Patchstack).

• Network: Unusual HTTP POST requests to WooCommerce AJAX endpoints or plugin-specific upload handlers containing multipart form data with .php, .phtml, .php5, or other executable file extensions; unexpected outbound connections from the web server process to external IPs.
• File System: Presence of unexpected .php files in wp-content/uploads/ or plugin upload directories (e.g., wp-content/plugins/drag-and-drop-file-upload-wc-pro/); newly created web shell files with names like shell.php, cmd.php, c99.php, or randomized names.
• Logs: Web server access logs showing POST requests to the plugin's upload endpoint followed by GET requests to newly created PHP files in upload directories; HTTP 200 responses to requests for PHP files in upload directories that should only contain media files.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM spawning bash, sh, curl, wget, or python); unexpected cron jobs or scheduled tasks added under the web server user account (Patchstack).

The primary remediation is to update the "Drag and Drop Multiple File Upload (Pro) - WooCommerce" plugin to version 5.0.7 or later, which contains the fix for this vulnerability (Patchstack). If immediate updating is not possible, Patchstack has issued a virtual patch/mitigation rule for its subscribers to block exploit attempts until the plugin is updated. Additional hardening measures include deploying a Web Application Firewall (WAF) to block suspicious file upload requests, configuring the web server to deny execution of PHP files in upload directories (e.g., via .htaccess rules), and auditing the server for any previously uploaded malicious files.

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," rated it as high priority and noted that CVSS 10 unauthenticated file upload vulnerabilities are commonly weaponized in mass-exploit campaigns against WordPress sites (Patchstack). The vulnerability was also highlighted in the Secret CISO newsletter on June 28, 2025, as part of a broader roundup of critical security issues. Red Hat tracked the CVE in its security advisory database, indicating broader industry awareness (Red Hat CVE).