CVE-2025-4387
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-06-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-4387 is an arbitrary file upload vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Due to missing file type validation in a specific function, an authenticated attacker with subscriber-level access or higher could upload any type of file to the server. This flaw allows attackers to potentially execute remote or local code depending on the server's configuration. The vulnerability was fixed in version 9.17.0 by restricting uploads to image file types only. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with low-level authenticated access to upload arbitrary files to your server, which may lead to remote or local code execution. This could result in unauthorized control over your website, data breaches, defacement, or further exploitation of your server depending on how it is configured. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability poses a security risk that could lead to unauthorized access or data breaches, which may impact compliance with standards like GDPR or HIPAA that require protection of personal and sensitive data. Although the plugin includes GDPR-compliant features, this vulnerability could undermine those protections if exploited. [1]
What immediate steps should I take to mitigate this vulnerability?
Update the Abandoned Cart Pro for WooCommerce plugin to version 9.17.0 or later, as this version restricts file uploads exclusively to image file types, preventing unauthorized arbitrary file uploads and mitigating the vulnerability. [1]