/Vulnerability Library

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

CVE-2025-47577
Verified

Description

TemplateInvaders TI WooCommerce Wishlist <= 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges.

Severity

High

CVSS Score

9.8

Exploit Probability

5%

Affected Product

ti-woocommerce-wishlist

Published Date

April 8, 2026

Template Author

cehcvkr

CVE-2025-47577.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-47577
CWE ID:
cwe-434

References

https://patchstack.com/articles/unpatched-critical-vulnerability-in-ti-woocommerce-wishlist-plugin/https://github.com/Yucaerin/CVE-2025-47577https://nvd.nist.gov/vuln/detail/CVE-2025-47577

Remediation Steps

Update to version 2.10.0 or later.