A critical security vulnerability has been identified in the TI WooCommerce Wishlist plugin for WordPress, potentially exposing over 100,000 websites to unauthorized file uploads and remote code execution. This flaw, designated as CVE-2025-47577 with a CVSS score of 10.0, affects all versions up to and including 2.9.2, released on November 29, 2024. As of now, no patch has been issued to address this issue.
Understanding the Vulnerability
The TI WooCommerce Wishlist plugin enables e-commerce customers to save products for future reference and share their wishlists on social media. The vulnerability resides in the plugin’s function `tinvwl_upload_file_wc_fields_factory`, which utilizes WordPress’s native `wp_handle_upload` function. However, it sets the parameters `test_form` and `test_type` to `false`, effectively bypassing essential file type and form validation checks. This oversight allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, leading to potential remote code execution on the server.
Exploitation Conditions
Exploitation of this vulnerability requires the WC Fields Factory plugin to be installed and activated on the WordPress site, with integration enabled in the TI WooCommerce Wishlist plugin. In such configurations, attackers can exploit the flaw to upload malicious files without authentication, posing significant security risks.
Potential Impact
If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, leading to unauthorized access, data breaches, and potential site defacement. The severity of this issue underscores the critical need for immediate action to mitigate potential threats.
Recommended Actions
In the absence of an official patch, users of the TI WooCommerce Wishlist plugin are strongly advised to deactivate and remove the plugin from their WordPress sites to prevent potential exploitation. Additionally, website administrators should monitor for any unusual activity and consider implementing additional security measures, such as web application firewalls, to protect against unauthorized file uploads.
Conclusion
The discovery of this critical vulnerability highlights the importance of regular security assessments and prompt updates to plugins and themes. Website owners must remain vigilant and proactive in addressing security flaws to safeguard their sites and user data.
