CVE-2025-60207: 
WordPress vulnerability analysis and mitigation

CVE-2025-60207 is an Unrestricted File Upload vulnerability (CWE-434) in the Custom User Registration Fields for WooCommerce plugin by Addify, allowing unauthenticated attackers to upload arbitrary files — including web shells — to the web server. It affects all plugin versions up to and including 2.1.2. The vulnerability was reported on June 14, 2025, and published on November 6, 2025 (with Patchstack's advisory dated July 14, 2025). It carries a CVSS v3.1 base score of 10.0 (Critical) (Patchstack).

The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the plugin fails to properly validate or restrict the file types accepted during the user registration process, allowing any file — including PHP web shells — to be uploaded without authentication. The attack vector is network-based, requires no privileges, no user interaction, and has low complexity, making it trivially exploitable remotely. The vulnerability is classified under OWASP Top 10 A3: Injection and is credited to researcher 0xd4rk5id3 (Patchstack).

Successful exploitation grants an unauthenticated attacker the ability to upload and execute arbitrary PHP code on the web server, resulting in full compromise of confidentiality, integrity, and availability. An attacker can deploy a persistent web shell, exfiltrate sensitive data (including WooCommerce customer and payment data), modify site content, or use the compromised server as a pivot point for lateral movement within the hosting environment. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable plugin itself to the underlying server and potentially co-hosted applications (Patchstack).

No official patch is currently available for this vulnerability as of the time of publication. The EPSS score is approximately 0.024%, indicating low observed exploitation activity to date. There is no current evidence of in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. However, Patchstack notes that vulnerabilities of this class (unauthenticated arbitrary file upload with CVSS 10) are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Custom User Registration Fields for WooCommerce" plugin (version ≤ 2.1.2) using tools like WPScan, Shodan, or by checking /wp-content/plugins/user-registration-plugin-for-woocommerce/ for plugin presence.
2. Locate the registration endpoint: Navigate to the WooCommerce user registration page where the plugin renders custom registration fields, including file upload fields.
3. Craft malicious upload request: Prepare a PHP web shell (e.g., <?php system($_GET['cmd']); ?>) saved with a .php extension. Submit it via the file upload field in the registration form without any authentication.
4. Identify upload path: After submission, determine the upload directory (typically within wp-content/uploads/ or a plugin-specific subdirectory) by observing server responses or using directory enumeration.
5. Execute web shell: Access the uploaded PHP file via its URL (e.g., https://target.com/wp-content/uploads/<shell>.php?cmd=id) to achieve remote code execution on the server.
6. Establish persistence: Use the shell to install a backdoor, create a rogue admin account, or exfiltrate the WordPress database credentials from wp-config.php (Patchstack).

• Network: Unexpected POST requests to the WooCommerce registration endpoint (/wp-login.php?action=register or custom registration pages) containing multipart file upload data with .php, .phtml, or other executable extensions from unauthenticated sources.
• File System: Presence of .php files in wp-content/uploads/ or plugin upload directories (e.g., wp-content/plugins/user-registration-plugin-for-woocommerce/uploads/) that were not placed there by administrators; web shell signatures such as system(), exec(), passthru(), or base64_decode() in uploaded files.
• Logs: Web server access logs showing GET/POST requests to newly created PHP files in upload directories, especially with query parameters like cmd=, exec=, or c=; registration form submissions with unusual Content-Type: multipart/form-data payloads containing PHP file extensions.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, or python) indicating web shell execution.

As of the publication date, no official patch is available from the plugin developer (Addify). The recommended immediate actions are:

• Deactivate and remove the Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.1.2) until a patched version is released.
• Deploy Patchstack: Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for subscribers while awaiting an official fix.
• Restrict file uploads at the web server or WAF level by blocking PHP file execution in upload directories (e.g., via .htaccess rules denying execution in wp-content/uploads/).
• Monitor upload directories for unexpected PHP files and review web server access logs for anomalous activity (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher 0xd4rk5id3, has flagged it as high priority and noted that CVSS 10 arbitrary file upload vulnerabilities are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant vendor statement from Addify, broader media coverage, or notable social media discussion has been identified at this time (Patchstack).