Introduction
Remote code execution on a WordPress e-commerce site can lead to theft of customer data, payment skimming, and full site takeover. CVE-2025-6440 exposes thousands of WooCommerce Designer Pro installations to unauthenticated arbitrary file upload, and no patch was available at publication time.
WooCommerce Designer Pro is a premium WordPress plugin by JMA Plugins. Online print shops and stores use it widely for product customization. It is sold on its own and also bundled with the Pricom Printing Company & Design Services WordPress theme. The plugin is popular among WooCommerce stores, and WooCommerce powers a significant portion of e-commerce sites worldwide.
Technical information
CVE-2025-6440 is a classic instance of CWE-434 (Unrestricted Upload of File with Dangerous Type). It affects all versions of WooCommerce Designer Pro up to and including 1.9.26. The root cause is missing file type validation in the wcdp_save_canvas_design_ajax function, which handles AJAX requests for saving user-generated product designs.
Vulnerability mechanism:
-
The plugin exposes an unauthenticated AJAX endpoint at:
wp-admin/admin-ajax.php?action=wcdp_save_canvas_design_ajax -
This endpoint accepts file uploads from any user, including unauthenticated visitors.
-
The server does not check whether an upload is a safe file type, such as an image. Anyone can upload files with any extension and content, including PHP scripts.
-
The plugin saves uploaded files to a web-accessible directory, typically under
wp-content/uploads/. -
An uploaded PHP file can then be requested directly over HTTP and executed, which gives remote code execution with the privileges of the web server process.
Root cause:
- No MIME type or file extension validation on the server side.
- No authentication or authorization required to reach the vulnerable AJAX handler.
- No nonce or CSRF protection on the endpoint.
The vulnerability is trivially exploitable and needs no prior access to the site. Similar flaws in other WordPress plugins have often led to mass exploitation campaigns.
Affected systems and versions
- WooCommerce Designer Pro plugin for WordPress
- All versions up to and including 1.9.26
- Any WordPress installation with this plugin active is vulnerable, regardless of configuration
- Sites using the Pricom Printing Company & Design Services WordPress theme are also affected, because the theme bundles the vulnerable plugin
Vendor security history
- JMA Plugins, the vendor of WooCommerce Designer Pro, has no public record of earlier vulnerabilities in this product
- Competing WooCommerce product designer plugins have had similar critical file upload vulnerabilities
- No patch has been released as of the disclosure date, which raises concerns about the vendor's response time and security maturity
