Critical · published December 29, 2025
🔥 A rogue file can easily turn into a remote command execution nightmare! Unauthenticated attackers can exploit this Arbitrary File Upload vulnerability in WMPro by Sunnet to upload malicious web shell backdoors. ⚠️ Think of it as allowing a delivery service to drop off packages without ever checking IDs—once a malicious package is inside, it can wreak havoc on your entire infrastructure! If exploited, an attacker could effectively take full control of the server, leading to data breaches, unauthorized access to sensitive information, or even complete system compromise. The consequences are absolutely devastating!
Think of it as allowing a delivery service to drop off packages without ever checking IDs—once a malicious package is inside, it can wreak havoc on your entire infrastructure! This vulnerability allows unauthenticated users to upload arbitrary files to the WMPro server, where they can execute arbitrary code, essentially bypassing all security measures in place.
If exploited, an attacker could effectively take full control of the server, leading to data breaches, unauthorized access to sensitive information, or even complete system compromise. The consequences are absolutely devastating! To mitigate this risk, immediately patch WMPro to the latest version released by Sunnet. Implement rigorous file upload validations, and consider enabling strict permissions on your server to limit execution capabilities. Don't forget to conduct a security audit! This is fixable! Follow the steps, and you’ll be a security hero in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sun.net/wmpro | ≥ 5.0, ≤ 5.2 | — |