CVE-2025-6440

CVE-2025-6440 is a critical (CVSS 9.8) unauthenticated arbitrary file upload flaw in the WooCommerce Designer Pro plugin for WordPress, caused by missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to and including 1.9.26. Because the AJAX endpoint requires no authentication or user interaction, any remote attacker can send a crafted request and upload arbitrary files, such as PHP files, to the affected site's server. Uploaded files can potentially lead to remote code execution, giving the attacker full control over the site and potentially its hosting environment. Sites are affected if they run the vulnerable plugin, including sites using the Pricom - Printing Company & Design Services WordPress theme that relies on this plugin. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but a 31.4% EPSS score (98th percentile) indicates an elevated probability of exploitation within the next 30 days.

What to do: Update the WooCommerce Designer Pro plugin to the latest patched release (any version later than 1.9.26); no fixed version number was specified in the source data. Until patched, restrict or block unauthenticated access to the plugin's AJAX endpoint (wcdp_save_canvas_design_ajax) via a WAF and audit the uploads directory for unexpected or recently added PHP files. Check web server logs for unauthenticated requests to the AJAX handler and look for webshells or unauthorized admin users, since file upload flaws of this type can yield full site compromise.