Cyber Resilience

CVE-2025-10412

Critical

Published: 23 September 2025

Published
23 September 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0105 78.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-10412 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Moomoo (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function. The flaw affects all versions through 4.9.55 and is tracked as CWE-434. It carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

Unauthenticated attackers can upload arbitrary files to the server, which may enable remote code execution on the affected WordPress site. The vulnerability allows direct file placement that bypasses intended restrictions, giving an adversary control over server content and potential execution of malicious code.

The EPSS score remains flat at 0.0105 with no material increase after disclosure. No information on real-world exploitation or available patches is provided in the supplied references.

EU & UK References

Vulnerability details

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.55.…

more

This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
Why these techniques?

Arbitrary file upload in public-facing WordPress plugin enables RCE via web shell deployment and tool transfer.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-6207Shared CWE-434
CVE-2024-50620Shared CWE-434
CVE-2025-12171Shared CWE-434
CVE-2025-26325Shared CWE-434
CVE-2025-6079Shared CWE-434
CVE-2024-13448Shared CWE-434
CVE-2025-51056Shared CWE-434
CVE-2025-66256Shared CWE-434
CVE-2026-32523Shared CWE-434
CVE-2025-6423Shared CWE-434

Affected Assets

Moomoo
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Remediating the specific flaw in the uni_cpo_upload_file function's file type validation directly prevents arbitrary file uploads and potential RCE.

SI-10 Information Input Validation good match
prevent

Requiring validation of file inputs like type, extension, and content blocks arbitrary files exploiting the plugin's misconfigured validation.

SI-9 Information Input Restrictions good match
prevent

Restricting allowed file types and sizes for uploads prevents unauthenticated attackers from submitting harmful arbitrary files to the WordPress server.

References