Introduction
A critical flaw in WooCommerce Designer Pro lets attackers upload a web shell and take full control of a WordPress e-commerce site. Any store running the plugin up to version 1.9.24 is affected, and a successful attack puts the store's sensitive data and business operations at risk.
WooCommerce Designer Pro is a premium plugin by HaruTheme that adds advanced product customization to WooCommerce stores. It is not as widely installed as core WooCommerce, but some online retailers use it to give their customers richer design features. Similar tools in the WordPress plugin ecosystem have had a series of high-impact vulnerabilities, so this issue is especially relevant for security teams managing e-commerce platforms.
Technical information
CVE-2025-60219 is a critical instance of CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability exists in WooCommerce Designer Pro from an unspecified starting version through 1.9.24. Attackers can use the plugin's file upload feature to place arbitrary files, including executable web shells, on the web server. This is typically possible because the upload handler does not properly validate file type, extension, or file content.
Based on similar WordPress plugin vulnerabilities, attackers may:
- Send crafted HTTP requests to endpoints that handle user uploads
- Manipulate MIME types or use double file extensions to get past weak checks
- Upload PHP or other executable files disguised as images or documents
Once uploaded, a malicious file can be requested directly over the web, which gives the attacker remote code execution. That leads to full site compromise, data theft, privilege escalation, and persistent access. No public code snippets or PoCs are available for this specific CVE.
Affected systems and versions
- Product: WooCommerce Designer Pro (by HaruTheme)
- Affected versions: All versions up to and including 1.9.24
- Vulnerable configurations: Any WordPress site with the plugin active in this version range
Vendor security history
We found no public record of prior vulnerabilities for HaruTheme. The wider market for WooCommerce product customization plugins has a different history. Similar products such as Fancy Product Designer have had repeated critical vulnerabilities, often with slow patch cycles and mass exploitation. For CVE-2025-60219, HaruTheme did not immediately release a patch or communicate about the issue.
