CVE-2025-2941

Critical

Published: 05 April 2025

Published

05 April 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0141 80.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2941 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 19.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to and including 1.1.4. The flaw is tracked as CWE-22 and carries a CVSS 3.1 score of 9.8.

Unauthenticated attackers can supply crafted values to the affected parameter and relocate arbitrary files on the underlying server. Successful exploitation can result in remote code execution, for example by relocating wp-config.php or other sensitive files into a web-accessible location.

A patched version of the plugin is available, as indicated by the changeset published on the WordPress plugin trac and referenced in the Wordfence advisory. The EPSS score for this CVE rose from a low baseline to a peak of 0.0340, indicating increased exploitation interest after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-9920

Vulnerability details

for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).

CWE(s): CWE-22

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Wordpress

—

inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.