CVE-2025-13391
Unauthorized File Deletion in WooCommerce Uni CPO via Missing Capability Check
Publication date: 2026-02-11
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moomoo_agency | uni_cpo | to 4.9.60 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress. It is caused by a missing capability check on the 'uni_cpo_remove_file' function in all versions up to and including 4.9.60.
This flaw allows unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if they know the file path.
The vulnerability was partially patched in version 4.9.60, but earlier versions remain vulnerable.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized deletion of files stored in Dropbox that are linked to the plugin, potentially causing loss of important attachments or data.
Since the attacker does not need to be authenticated, it increases the risk of malicious file deletions without any user verification.
The impact is limited to integrity (I) loss, meaning data can be altered or deleted, but confidentiality (C) and availability (A) are not directly affected according to the CVSS score.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Uni CPO plugin for WordPress allows unauthenticated attackers to delete arbitrary files due to a missing capability check in versions up to and including 4.9.60.
To mitigate this vulnerability immediately, update the Uni CPO plugin to a version later than 4.9.60 where the issue has been partially patched.