Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'uni_cpo_remove_file' function in all versions up to, and including, 4.9.60. This makes it possible for unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if the file path is known. The vulnerability was partially patched in version 4.9.60.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-11 | 1 | General1 |
| 2026-02-12 | 1 | Disclosure1 |
CVE-2025-13391 Unauthenticated File Deletion Vulnerability in WooCommerce Uni CPO Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-13391
Post summary
A new unauthenticated file deletion vulnerability (CVE-2025-13391) has been identified in the WooCommerce Uni CPO Plugin.
CVE-2025-13391 The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missin… https://www.cve.org/CVERecord?id=CVE-2025-13391
Post summary
The post refers to CVE‑2025‑13391, noting a data‑loss issue in the Uni CPO plugin, but offers no detailed technical information, patches, or evidence of exploitation.