CVE-2025-22782

Critical

Published: 15 January 2025

Published

15 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0044 63.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22782 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22782 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Web Ready Now WR Price List Manager For Woocommerce WordPress plugin (wr-price-list-for-woocommerce). This issue affects all versions from n/a through 1.0.8 and allows attackers to upload a web shell to the web server. The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), marking it as critical.

An authenticated attacker with low privileges, such as a standard WordPress user, can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation enables the upload of a web shell, resulting in remote code execution (RCE) with high impacts on confidentiality, integrity, and availability, along with a change in scope.

The Patchstack advisory provides further details on this remote code execution vulnerability in WR Price List Manager For Woocommerce version 1.0.8: https://patchstack.com/database/Wordpress/Plugin/wr-price-list-for-woocommerce/vulnerability/wordpress-wr-price-list-manager-for-woocommerce-plugin-1-0-8-remote-code-execution-rce-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2992

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects WR Price List Manager For Woocommerce: from n/a through <=…

1.0.8.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability enables exploitation of a public-facing web application (WordPress plugin) via unrestricted file upload, directly facilitating deployment of a web shell for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1