Introduction
A single file upload can lead to remote code execution, data theft, and full compromise of a WooCommerce store. Retailers running the Vitepos Point of Sale plugin should treat CVE-2025-13156 as urgent, because it puts both store operations and customer data at risk.
Vitepos is a point of sale plugin for WooCommerce, developed by AppsBD and built to connect physical retail with online stores. It serves a niche part of the WordPress ecosystem, but with over 1,000 active installations, one vulnerability can reach a significant number of small and medium-sized businesses.
Technical Information
CVE-2025-13156 is a high-severity arbitrary file upload vulnerability (CVSS 8.8) in all versions of the Vitepos Point of Sale plugin for WooCommerce up to and including 3.3.0. The root cause is missing file type validation in the save_update_category_img() function, which handles category image uploads. The function takes user-supplied files and passes them to insert_media_attachment() without checking that the file is a real image. Any authenticated user with subscriber-level access or higher can therefore upload arbitrary files, including executable PHP scripts.
An attack works like this:
- The attacker logs into a vulnerable WooCommerce site with subscriber credentials.
- The attacker opens the category image upload functionality.
- The attacker submits a crafted file, such as a PHP web shell, instead of an image.
- The plugin enforces no file type restrictions at any point in the upload process, so it stores the malicious file in a web-accessible directory.
- The attacker requests the file over HTTP, which runs the code with the privileges of the web server process.
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Subscriber-level accounts are easy to get on many WooCommerce sites, either through open registration or by compromising a low-privilege user account, and that raises the risk. No public code snippets are available, but multiple advisories and the plugin's changelog confirm how the vulnerability works.
Affected Systems and Versions
All versions of the Vitepos Point of Sale plugin for WooCommerce up to and including 3.3.0 are vulnerable. Any configuration is affected where the plugin is installed and active and where users with subscriber-level access or above can upload category images. Version 3.3.1 and later fix the issue.
Vendor Security History
AppsBD, the developer of Vitepos, has a documented history of security issues in this plugin. Earlier vulnerabilities include CVE-2024-33574, a missing authorization check, along with other authentication-related flaws. The vendor has released updates in response to reported vulnerabilities, but it does not maintain a dedicated security advisory page. Access control and input validation problems keep recurring, which suggests its security processes could be improved.
