Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2025-6440

Exploit for CVE-2025-6440: unauthenticated arbitrary file upload in WooCommerce Designer Pro WordPress plugin, enabling RCE via malicious PHP upload.

View Repository

13 months ago

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

🧨 CVE-2025-6440 – WooCommerce Designer Pro Unrestricted File Upload

Unauthenticated Arbitrary File Upload via wcdp_save_canvas_design_ajax
WooCommerce Designer Pro plugin – Remote Code Execution (RCE)

📖 Description

The WooCommerce Designer Pro plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability in the AJAX action . An attacker can upload any file (including malicious PHP scripts) without authentication, leading to .

wcdp_save_canvas_design_ajax

Remote Code Execution (RCE)

CVSS Score: 9.8 (Critical)
CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Attack Vector: Network | Complexity: Low | Privileges: None

⚡ Affected Versions

Plugin	Vulnerable Versions
WooCommerce Designer Pro	All versions (unpatched)

Note: This vulnerability has been assigned CVE-2025-6440. The plugin may be discontinued. No patch is available.

🔬 Proof of Concept (PoC)

🐍 Python Exploit

root@kitploit:~

python CVE-2025-6440.py -u http://target.com/wordpress

Download Tool