CVE-2025-4387CWE-434

Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload

High · published June 10, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00558 · 45.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-06-10T03:41Z
EPSS history
Timeline
  • 10 JUN 03:41Z
    Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload
    cvelistv5