VulnSocial

CVE-2025-6440Exploit

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • Exploit tooling references are present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-21: 1Exploit Tool / Code · 2026-09-21: 1Technical Details · 2026-09-21: 109-21
Signal classification1 categories
Exploit
1100.0%
Full discourse1 post
  • General Intels Daily@intels_daily
    Exploit

    🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝘀𝗮𝗹𝗲 🧩 Product: 𝗪𝗼𝗼𝗖𝗼𝗺𝗺𝗲𝗿𝗰𝗲 𝗗𝗲𝘀𝗶𝗴𝗻𝗲𝗿 𝗣𝗿𝗼 🛡️ CVE-2025-6440 Threat actor lBaldwin is offering an exploit tool for CVE-2025-6440, a critical arbitrary file upload vulnerability affecting WooCommerce Designer Pro plugin versions 1.9.26 and earlier, allowing for remote code execution and site takeover. #ExploitSale #Exploit #ThreatIntel #CTI

    Post summary

    The text reports that threat actor lBaldwin is selling an exploit tool for CVE-2025-6440, a critical arbitrary file upload vulnerability in WooCommerce Designer Pro that leads to remote code execution and site takeover. No patch, proof of concept, or confirmed active exploitation is mentioned.

    00000133
    692 followersView on X

Explore more

Back to dashboard