CVE-2025-11391

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11391", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-06T20:04:27.764Z", "datePublished": "2025-10-18T06:42:48.390Z", "dateUpdated": "2026-04-08T17:24:40.895Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:40.895Z"}, "affected": [{"vendor": "themeisle", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "33.0.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated."}], "title": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "timeline": [{"time": "2025-10-06T20:07:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T18:09:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T18:30:31.634936Z", "id": "CVE-2025-11391", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:30:53.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11391", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-20T18:30:31.634936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:30:40.606Z"}}], "cna": {"title": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Talal Nasraddeen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "themeisle", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "33.0.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-06T20:07:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T18:09:32.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:40.895Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11391", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:40.895Z", "dateReserved": "2025-10-06T20:04:27.764Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:48.390Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PPOM \u2013 Product Addons & Custom Fields for WooCommerce", "vendor": "themeisle", "versions": [{"lessThanOrEqual": "33.0.15", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated."}, {"lang": "es", "value": "El plugin PPOM - Product Addons & Custom Fields para WooCommerce para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en la funcionalidad de recorte de im\u00e1genes en todas las versiones hasta la 33.0.15, inclusive. Esto permite a atacantes no autenticados cargar archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo. Aunque el c\u00f3digo vulnerable se encuentra en la versi\u00f3n gratuita, esto solo afectaba a los usuarios con la versi\u00f3n de pago del software instalada y activada."}], "id": "CVE-2025-11391", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11391", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T18:30:31.634936Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:35.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:13:20.131828+00:00", "value": {"mitigation_remediation": ["Upgrade the PPOM plugin to versions 33.0.16 or newer, or uninstall the plugin if it is not needed.", "Disable the image cropper feature or restrict its usage to authenticated administrators only.", "Configure the web server so that the uploads directory does not allow execution of uploaded files, for example by setting the correct file permissions or adding a .htaccess rule that blocks PHP execution."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the PPOM plugin with versions 33.0.15 or earlier, and that have the paid edition active. The free edition contains the code but the flaw only manifests when the paid features are enabled. No other vendors or products are listed.", "description_and_impact": "The PPOM \u2013 Product Addons & Custom Fields for WooCommerce plugin allows unauthenticated users to upload any file because the image cropper does not validate the file type. The absence of checks enables the upload of executable code, which could lead to remote code execution on the host web server. This vulnerability is classified as CWE\u2011434, indicating a failure to restrict file types or extensions during upload.", "risk_and_exploitability": "The CVSS score of 9.8 reflects the severity of this flaw, while the EPSS score of less than 1\u202f% indicates that, at present, exploitation is unlikely but the impact would be catastrophic if it occurs. The vulnerability is not yet listed in the CISA KEV catalog, so no known exploit has been reported. Attackers would need to send a crafted HTTP request to the plugin\u2019s image cropper endpoint; authentication is not required, so anyone on the public internet can attempt the upload."}}}}, "created": "2025-10-20T13:21:39.033732+00:00", "updated": "2026-04-21T02:15:06.531812+00:00", "vendors": ["themeisle", "themeisle$PRODUCT$product_addons_&_fields_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}