CVE-2025-47577

WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a before 2.10.0.

Affected

templateinvaders · TI WooCommerce Wishlist

CVSS v3.1 PATCHSTACK

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

4.59% chance of exploitation in the next 30 days, 92nd percentile

Nuclei

high · CWE-434

Published

2025-05-19

Updated

2026-05-12

Proof-of-concept exploits (2)

• Yucaerin/CVE-2025-475774★ · 2025-05-30
• sug4r-wr41th/CVE-2025-475770★ · 2025-06-25

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47577.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-55555
• CVE-2025-2294
• CVE-2025-2539
• CVE-2025-2907
• CVE-2025-3419
• CVE-2025-4322