Platform
wordpress
Component
user-registration-plugin-for-woocommerce
Fixed in
2.1.3
CVE-2025-60207 is an Arbitrary File Access vulnerability affecting the Addify Custom User Registration Fields for WooCommerce plugin. This flaw allows attackers to upload files of any type, including malicious web shells, to the web server. Versions of the plugin from 0 through 2.1.2 are vulnerable. A patch is available in version 2.1.3.
The primary impact of CVE-2025-60207 is the ability for an attacker to upload arbitrary files to the web server. This includes web shells, which provide remote code execution (RCE) capabilities. Successful exploitation could lead to complete server compromise, allowing attackers to steal sensitive data, modify website content, or use the server as a launchpad for further attacks. The vulnerability's unrestricted file upload nature significantly expands the attack surface, as attackers are not limited to specific file types. Given the plugin's function within WooCommerce, a compromised site could expose customer data, order information, and potentially payment details. The blast radius extends beyond the immediate website, potentially impacting the entire WooCommerce ecosystem if the compromised server is used to propagate malware or launch attacks against other systems.
CVE-2025-60207 was published on 2025-11-06. Its CRITICAL CVSS score indicates a high probability of exploitation. While no public Proof-of-Concept (POC) exploits have been publicly released as of this writing, the unrestricted file upload nature of the vulnerability makes it a likely target for exploitation. The vulnerability is not currently listed on CISA Known Exploited Vulnerabilities (KEV) catalog, but its severity warrants close monitoring. The EPSS score is likely to be assessed as high due to the ease of exploitation and potential impact.
Exploit Status
EPSS
0.08% (24% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-60207 is to immediately upgrade the Addify Custom User Registration Fields for WooCommerce plugin to version 2.1.3 or later. If upgrading is not immediately feasible, implement temporary workarounds to reduce the risk. These include restricting file uploads to only explicitly allowed types using server-level configurations (e.g., .htaccess rules) and implementing strict file size limits. Consider using a Web Application Firewall (WAF) with rules to block suspicious file uploads, particularly those containing common web shell code patterns. Regularly scan the server for unauthorized files and monitor file upload logs for unusual activity. After upgrading to version 2.1.3, verify the fix by attempting to upload a non-allowed file type (e.g., a .php file) through the user registration process; the upload should be rejected.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
It's a CRITICAL vulnerability in the Addify Custom User Registration Fields for WooCommerce plugin allowing attackers to upload any file, including web shells, potentially leading to full server compromise.
If you are using Addify Custom User Registration Fields for WooCommerce versions 0 through 2.1.2, you are vulnerable. Check your plugin versions immediately.
Upgrade the plugin to version 2.1.3 or later. If immediate upgrade isn't possible, implement temporary workarounds like restricting file types and using a WAF.
While no public exploits are currently available, the vulnerability's severity makes it a likely target, so proactive mitigation is crucial.
Refer to the official WooCommerce security advisories and the Addify plugin developer's website for updates and further information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.