CVE-2025-60219: Arbitrary File Access in WooCommerce Designer Pro

The primary impact of CVE-2025-60219 is the ability for an attacker to gain complete control over the affected WordPress website. By uploading a web shell (e.g., a PHP script), an attacker can execute arbitrary code on the server with the privileges of the web server user. This could lead to data exfiltration, website defacement, malware deployment, and lateral movement within the network. The unrestricted file upload bypasses standard WordPress security measures, making exploitation relatively straightforward. The blast radius extends beyond the immediate website, potentially impacting any systems accessible from the compromised server. This vulnerability shares similarities with other unrestricted file upload flaws, where attackers leverage the ability to execute code on the server to achieve their objectives.

1. Reserved2025-09-25
2. Published2025-09-26
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-60219 is to immediately upgrade WooCommerce Designer Pro to version 1.9.25 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These include restricting file uploads to only explicitly allowed file types through WordPress's built-in file upload filters, and implementing a Web Application Firewall (WAF) rule to block uploads of common web shell extensions (e.g., .php, .jsp, .asp). Additionally, review server configurations to ensure proper file permissions are in place, preventing the execution of uploaded files. After upgrading, verify the fix by attempting to upload a test file with a known malicious extension; the upload should be rejected.