Introduction
Attackers can gain remote code execution on WooCommerce-powered WordPress sites by exploiting a critical flaw in the Uni CPO Premium plugin. The flaw allows unauthenticated file uploads, so any e-commerce business running an affected version is at risk of full site compromise and a data breach.
Uni CPO Premium is a WooCommerce extension from Moomoo Agency that adds advanced product options and price calculation formulas to online stores. It is widely used among WooCommerce stores and runs on a significant number of WordPress sites that handle sensitive customer and transaction data.
Technical Information
CVE-2025-10412 is a critical vulnerability caused by insufficient file type validation in the uni_cpo_upload_file function of the Uni CPO Premium plugin. It affects all versions up to and including 4.9.54. The function does not properly restrict which file types can be uploaded, so unauthenticated users can upload arbitrary files to the server.
An attacker exploits this by sending HTTP requests directly to the file upload endpoint that the plugin exposes. The function enforces no authentication and no robust file type check, so an attacker can upload a malicious file such as a PHP web shell and then execute it. That gives the attacker remote code execution and full control of the site, and it may let them keep persistent access or pivot further into the environment.
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). No public code snippets are available at this time, but the attack vector is clear. A misconfigured upload handler in the plugin accepts files from unauthenticated users.
Affected Systems and Versions
- Product: Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress
- Affected versions: All versions up to and including 4.9.54
- Vulnerable configuration: Any WordPress site with the affected plugin version installed and active
Vendor Security History
Moomoo Agency, the developer of Uni CPO, has fixed security issues in this plugin before, including cross-site scripting and input validation flaws. The vendor has released patches in response to disclosures, but the repeated vulnerabilities indicate that it needs stronger secure development and testing practices.
