CVE-2025-11391

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.

• CWE-434

• https://plugins.trac.wordpress.org/browser/woocommerce-product-addon/trunk/inc/hooks.php#L45
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379431%40woocommerce-product-addon&new=3379431%40woocommerce-product-addon&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=cve

Published

Oct 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11386A vulnerability was found in Tenda AC15 15.03.05.18. The imp…8.8
• CVE-2025-11387A vulnerability was determined in Tenda AC15 15.03.05.18. Th…8.8
• CVE-2025-11388A vulnerability was identified in Tenda AC15 15.03.05.18. Th…8.8
• CVE-2025-11389A security flaw has been discovered in Tenda AC15 15.03.05.1…8.8
• CVE-2025-1139IBM Edge Application Manager 4.5 could allow a local user to…4.4
• CVE-2025-11390A weakness has been identified in PHPGurukul Cyber Cafe Mana…6.1
• CVE-2025-11393A flaw was found in runtimes-inventory-rhel8-operator. An in…8.7
• CVE-2025-11396A vulnerability was identified in code-projects Simple Food …9.8
• CVE-2025-11397A security flaw has been discovered in SourceCodester Hotel …9.8
• CVE-2025-11398A weakness has been identified in SourceCodester Hotel and L…8.8
• CVE-2025-11399A security vulnerability has been detected in SourceCodester…9.8
• CVE-2025-11400A vulnerability was detected in SourceCodester Hotel and Lod…9.8