CVE-2025-6440

Critical

Published: 24 October 2025

Published

24 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0033 56.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6440 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Codecanyon (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the missing file type validation by requiring validation of all information inputs, including uploaded files, to ensure consistency with expected content.

SI-2 Flaw Remediation good match

prevent

Mitigates the vulnerability by requiring timely identification, reporting, and correction of flaws in the WooCommerce Designer Pro plugin.

SI-3 Malicious Code Protection good match

preventdetect

Protects against exploitation by deploying mechanisms to detect and eradicate malicious code, such as web shells uploaded via the vulnerable AJAX endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Unauthenticated arbitrary file upload vulnerability in a public-facing WordPress plugin enables exploitation of public-facing applications (T1190) and facilitates deployment of web shells (T1100) for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to,…

and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Deeper analysisAI

CVE-2025-6440 is an arbitrary file upload vulnerability in the WooCommerce Designer Pro plugin for WordPress, as used by the Pricom - Printing Company & Design Services WordPress theme. The flaw arises from missing file type validation in the 'wcdp_save_canvas_design_ajax' function, affecting all versions up to and including 1.9.26. Classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact compromise.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction or privileges required. By sending crafted requests to the vulnerable AJAX endpoint, they can upload arbitrary files to the affected site's server, which may lead to remote code execution depending on server configuration and file types uploaded, such as web shells.

Advisories provide further details on mitigation, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2f8da1-7503-45e3-8a7d-0031ce264edf?source=cve and the plugin listing on Codecanyon at https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731. Practitioners should review these sources for patch availability or workarounds, such as updating to a fixed version if released or disabling the plugin.