CVE-2025-11391

Critical

Published: 18 October 2025

Published

18 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0057 69.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11391 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-11391 is an arbitrary file upload vulnerability in the PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress, stemming from missing file type validation in the image cropper functionality. This flaw affects all versions up to and including 33.0.15. Notably, while the vulnerable code exists in the free version of the plugin, exploitation only impacts sites where the paid version is installed and activated. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Unauthenticated attackers can exploit this issue remotely with low complexity to upload arbitrary files directly onto the affected WordPress site's server. Successful exploitation may lead to remote code execution, allowing attackers to compromise the server, execute malicious code, and potentially gain full control over the site.

Advisories and patch details are documented in the Wordfence threat intelligence report and the plugin's WordPress.org trac repository, including the vulnerable code at hooks.php line 45 and the associated fix in changeset 3379431.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-34973

Vulnerability details

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes…

it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Unauthenticated arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing applications (T1190) and facilitates web shell deployment for remote code execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0