Description
WordPress Drag and Drop Multiple File Upload for WooCommerce插件1.1.6及以下版本存在任意文件上传漏洞，由于upload（）函数未对用户提供的supported_type字符串和上传文件名进行真实扩展名或MIME类型检查，未经身份验证的攻击者可上传任意文件到受影响站点的服务器，可能导致远程代码执行。
WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-4403
https://www.sentinelone.com/vulnerability-database/cve-2025-4403/
https://github.com/Yucaerin/CVE-2025-4403
https://vulners.com/cve/CVE-2025-4403
https://xie.infoq.cn/article/b8a23b66ef6fdf150a2aa1852
https://www.wordfence.com/blog/2025/05/wordfence-intelligence-weekly-wordpress-vulnerability-report-may-5-2025-to-may-11-2025/
https://sploitus.com/exploit?id=F8AEF680-3F60-5D24-9911-E9BD704CBD9C