CVE-2025-2941 — AI Deep Analysis Summary

🚨 **Essence**: Path Traversal (CWE-22) in 'Drag and Drop Multiple File Upload for WooCommerce'. 💥 **Consequences**: Arbitrary file movement.…

🔍 **Root Cause**: Insufficient file path validation. 🛡️ **CWE**: CWE-22 (Path Traversal). The plugin fails to sanitize user-supplied file paths, allowing directory traversal sequences (e.g., `../`) to bypass security con…

🏢 **Vendor**: glenwpcoder. 📦 **Product**: Drag and Drop Multiple File Upload for WooCommerce. ⚠️ **Affected Versions**: 1.1.4 and earlier. 🌐 **Platform**: WordPress + WooCommerce ecosystem.

🕵️ **Attacker Actions**: Move arbitrary files. 📂 **Impact**: High Confidentiality, Integrity, and Availability impact (CVSS H/H/H). 🔓 **Privileges**: No authentication required (PR:N).…

📉 **Threshold**: LOW. 🔑 **Auth**: None required (PR:N). 🌐 **Network**: Network accessible (AV:N). ⚡ **Complexity**: Low (AC:L). 👀 **UI**: No user interaction needed (UI:N). Easy to exploit remotely.

📜 **Public Exp?**: No specific PoC provided in data. 🌍 **Wild Exp**: References from WordFence and WordPress Trac exist. ⚠️ **Risk**: High likelihood of existing exploits due to low barrier to entry and public disclosure…

🔎 **Self-Check**: Scan for plugin version < 1.1.5. 🛠️ **Method**: Check WordPress admin dashboard or source code for 'Drag and Drop Multiple File Upload for WooCommerce'. 📊 **Indicator**: Look for file upload handlers la…

🛡️ **Fix**: Update plugin to version 1.1.5 or later. 📝 **Source**: WordPress Plugin Repository & Trac changesets. ✅ **Status**: Patch available via official vendor channels.

🚧 **No Patch?**: Disable the plugin immediately. 🔒 **Mitigation**: Restrict file upload permissions via server config (e.g., Nginx/Apache). 🧹 **Audit**: Review uploaded files for anomalies.…

🔥 **Urgency**: CRITICAL. 📅 **Priority**: Patch Immediately. ⏳ **Reason**: CVSS 9.1 (High), no auth required, active references. High risk of immediate exploitation in the wild.