CVE-2025-13156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13156", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-13T22:02:28.030Z", "datePublished": "2025-11-21T08:28:15.190Z", "dateUpdated": "2026-04-08T17:18:56.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:56.867Z"}, "affected": [{"vendor": "appsbd", "product": "Vitepos \u2013 Point of Sale (POS) for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible."}], "title": "Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3398044"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "timeline": [{"time": "2025-11-05T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-16T10:55:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-20T19:52:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T14:41:22.418514Z", "id": "CVE-2025-13156", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:55:31.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-21T14:41:22.418514Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T14:41:23.121Z"}}], "cna": {"title": "Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "appsbd", "product": "Vitepos \u2013 Point of Sale (POS) for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-05T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-16T10:55:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-20T19:52:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3398044"}], "descriptions": [{"lang": "en", "value": "The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:56.867Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13156", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:18:56.867Z", "dateReserved": "2025-11-13T22:02:28.030Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-21T08:28:15.190Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vitepos \u2013 Point of Sale (POS) for WooCommerce", "vendor": "appsbd", "versions": [{"lessThanOrEqual": "3.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible."}, {"lang": "es", "value": "El plugin Vitepos - Punto de Venta (POS) para WooCommerce para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n 'insert_media_attachment()' en todas las versiones hasta la 3.3.0, inclusive. Esto se debe a que la funci\u00f3n 'save_update_category_img()' acepta tipos de archivo proporcionados por el usuario sin validaci\u00f3n al procesar im\u00e1genes de categor\u00eda. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que hace posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-13156", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13156", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T14:41:22.418514Z", "version": "2.0.3"}}]}, "published": "2025-11-21T09:15:46.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3398044"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:24:53.670263+00:00", "value": {"mitigation_remediation": ["Upgrade Vitepos to the latest version that includes the upload validation fix", "Revoke upload and media management capabilities from any roles below administrator, limiting subscriber\u2011level users to read\u2011only access", "Configure the web server or application to disable execution of files in the upload directory and whitelist allowed MIME types", "Maintain regular update cycles for WordPress core, plugins, and themes to prevent similar flaws"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Vitepos \u2013 Point of Sale (POS) for WooCommerce by appsbd. All plugin versions up to and including 3.3.0 are vulnerable. The issue appears in every WordPress instance that has Vitepos installed and any subscriber or higher role is permitted to add or edit product categories. The vulnerability does not affect earlier or newer releases beyond 3.3.0.", "description_and_impact": "The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin suffers from missing file type validation in the insert_media_attachment() function. The save_update_category_img() function accepts user\u2011supplied file types without verification, enabling authenticated users with subscriber level access or higher to upload arbitrary files. Because the uploaded files are stored on the server\u2019s filesystem and are not validated, an attacker can place executable code and achieve remote code execution on the host. This flaw is a classic file\u2011upload vulnerability (CWE\u2011434).", "risk_and_exploitability": "The CVSS score is 8.8, indicating a high severity. The EPSS score is less than\u202f1%, suggesting exploitation is presently rare, and the vulnerability is not listed in CISA KEV. However, the required privilege is only a subscriber\u2011level account, which is common on many e\u2011commerce sites. If an attacker compromises a subscriber account or gains social\u2011engineering access, they can upload a malicious file, bypass server\u2011side validation, and execute code. The attack vector is through the insert_media_attachment() routine triggered during category image updates, so only authenticated users with the necessary role can exploit it."}}}}, "created": "2025-11-24T09:09:56.952670+00:00", "updated": "2026-04-21T01:30:24.396593+00:00", "vendors": ["appsbd", "appsbd$PRODUCT$vitepos", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}