Introduction
Attackers can upload arbitrary JavaScript files to any WordPress site running the Easy Upload Files During Checkout plugin up to version 2.9.8. This exposes e-commerce platforms to remote code execution and persistent JavaScript injection, and the impact falls directly on both site operators and customers.
Easy Upload Files During Checkout is a popular WooCommerce add-on that lets customers attach files during checkout. Fahad Mahmood maintains it, and it is distributed through the official WordPress plugin repository. The plugin is widely used across WooCommerce, which powers a significant portion of e-commerce sites worldwide.
Technical Information
CVE-2025-12682 is caused by missing file type validation in the file_during_checkout function of the Easy Upload Files During Checkout plugin for WordPress. All versions up to and including 2.9.8 are affected. The plugin is meant to let users upload files (such as images or documents) during WooCommerce checkout. However, the vulnerable function does not properly check the type of uploaded files, so attackers can upload arbitrary JavaScript files.
The upload endpoint does not require authentication, which means any remote user can submit a crafted HTTP POST request containing a JavaScript file. If the server stores these files in a web-accessible directory (such as wp-content/uploads), the attacker can then access or serve the malicious file. Depending on server configuration, this may lead to stored cross-site scripting or remote code execution. The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.
No code snippets from the vulnerable function are publicly available at this time.
Affected Systems and Versions
- Product: Easy Upload Files During Checkout plugin for WordPress
- Affected versions: All versions up to and including 2.9.8
- Vulnerable configuration: Any WordPress installation with the plugin enabled and file uploads allowed during checkout
Vendor Security History
Fahad Mahmood maintains the Easy Upload Files During Checkout plugin. No prior major vulnerabilities have been publicly documented for it. Arbitrary file upload flaws do recur across WordPress plugins, though, and similar issues have been reported in other WooCommerce-related plugins. Available public information is not enough to fully assess the vendor's patch response time or overall security maturity.
