Critical · published April 5, 2025
🔥 Unauthenticated attackers can move any file around on your server! The Drag and Drop Multiple File Upload for WooCommerce plugin is so trusting, it allows file manipulation without proper validation. 🚨 Think of your server as a library, and this vulnerability as a librarian who lets anyone re-shelve books without checking if they belong there. An attacker could simply slide a nefarious file into an important area, like the library's special archives, potentially leading to chaos! If exploited, a hacker could move critical files like wp-config.php, giving them the keys to the kingdom! This could lead to full remote code execution, allowing attackers to take over your site entirely — a nightmare scenario that could compromise not just your data but your users' as well.
Think of your server as a library, and this vulnerability as a librarian who lets anyone re-shelve books without checking if they belong there. An attacker could simply slide a nefarious file into an important area, like the library's special archives, potentially leading to chaos! This vulnerability arises from insufficient file path validation in the wc-upload-file[] parameter of the WooCommerce plugin, allowing unauthenticated users to move arbitrary files on the server without proper checks.
If exploited, a hacker could move critical files like wp-config.php, giving them the keys to the kingdom! This could lead to full remote code execution, allowing attackers to take over your site entirely — a nightmare scenario that could compromise not just your data but your users' as well. To safeguard your site, immediately update the WooCommerce Drag and Drop Multiple File Upload plugin to version 1.1.5 or higher. Additionally, review server permissions and consider implementing stricter path validation to prevent unauthorized file movements. You've got this! Taking these steps will help secure your site and keep those pesky intruders at bay! 🛡️