CVE-2025-4403Active Exploitation

LOWCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2025-4403

Full discourse1 post

0day Signal@0dayPublishing185d
Active Exploitation
🚨 CVE-2025-4403: Drag and Drop M... User-controlled `supported_type` bypass + zero file validation = instant webshell upload on 50k+ WooCommerce sites. #RCE #WordPress #0day. https://zerodaysignal.com/vulnerability/CVE-2025-4403 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet confirms that CVE-2025-4403 is widely exploited, allowing webshell uploads on over 50,000 WooCommerce sites via a supported_type bypass, yet no patch or PoC is referenced.
00000435
204 followersView on X

Explore more

Back to dashboard