Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2025-13391 — AI Deep Analysis Summary

CVSS 5.8 · Medium

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Arbitrary File Deletion Vulnerability**! In the WooCommerce Uni CPO plugin, the `uni_cpo_remove_file` function lacks permission checks, allowing attackers to delete any file in Dropbox, leading to **data loss**. 💔

Q2Root Cause? (CWE/Flaw)

🔍 **CWE-250**: Missing Permission Check. The function does not verify caller permissions, enabling unauthorized users to perform file deletion operations. ❌

Q3Who is affected? (Versions/Components)

⚠️ **Affects all versions**, including 4.9.60 and earlier. Component: WooCommerce – Uni CPO (Premium) plugin. 📦

Q4What can hackers do? (Privileges/Data)

💥 **No Authentication Required**! If attackers know the file path, they can delete any attachment or file in Dropbox, causing **data destruction**. 🗑️

Q5Is exploitation threshold high? (Auth/Config)

📉 **Very Low Barrier**! No login or authentication required—only knowledge of the file path is needed to exploit. 🌐

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔍 **No Public PoC**! No known exploit code or in-the-wild attack reports currently exist. 🛡️

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check Method**: Verify if the Uni CPO plugin is installed on your site and if the version is ≤ 4.9.60; check whether the `uni_cpo_remove_file` function call lacks permission verification. 📋

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Partially Fixed**! Version 4.9.60 has addressed some issues, but the risk is not fully eliminated. ⚠️

Q9What if no patch? (Workaround)

🛡️ **Temporary Mitigation**: Disable the plugin, restrict file access paths, and monitor logs for abnormal deletion activities. 🔒

Q10Is it urgent? (Priority Suggestion)

⚠️ **High Priority**! Data can be deleted arbitrarily, impacting business continuity—immediate action is recommended. 🔥