Woocommerce — PoC Archivehttps://poc.intelseclab.com/tags/woocommerce/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000WooCommerce Dynamic Pricing & Discounts (WC Designer Pro) Unauthenticated File Upload RCE (CVE-2025-6440)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleiWebkul Medical Prescription Attachment for WooCommerce — Unrestricted File Upload to Web Shell (CVE-2025-29009)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Critical severity (CVSS 10) — web · CVE-2025-29009. Status: Weaponized. Affects: Webkul "Medical Prescription Attachment Plugin for WooCommerce" (WordPress plugin). Tags: wordpress, woocommerce, medical-prescription-attachment, unrestricted-file-upload, webshell, cwe-434, unauthenticated, python.webCriticalwordpresswoocommercemedical-prescription-attachmentunrestricted-file-uploadwebshellcwe-434unauthenticatedpythonStoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-48148. Status: Weaponized. Affects: StoreKeeper for WooCommerce (WordPress plugin). Tags: wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python.webCriticalwordpresswoocommercestorekeeperarbitrary-file-uploadunauthenticatedwebshellrcecwe-434pythonPPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-11391. Status: Patched. Affects: PPOM for WooCommerce (woocommerce-product-addon plugin). Tags: wordpress, woocommerce, ppom, product-addon, sql-injection, blind-sqli, time-based, cwe-89, python, php.webCriticalwordpresswoocommerceppomproduct-addonsql-injectionblind-sqlitime-basedcwe-89pythonphpYayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1937-yaymail-woocommerce-privesc/High severity (CVSS 7.2) — web · CVE-2026-1937. Status: Weaponized. Affects: YayMail – WooCommerce Email Customizer plugin for WordPress. Tags: wordpress, woocommerce, plugin, missing-authorization, privilege-escalation, mass-exploitation, ajax.webHighwordpresswoocommercepluginmissing-authorizationprivilege-escalationmass-exploitationajaxWooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Critical severity (CVSS 9.8) — web · CVE-2026-27542 (bundled with CVE-2026-27540). Status: Weaponized. Affects: WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress. Tags: wordpress, woocommerce, plugin, privilege-escalation, file-upload, rce, unauthenticated, mass-scanning.webCriticalwordpresswoocommercepluginprivilege-escalationfile-uploadrceunauthenticatedmass-scanningWooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54807-woocommerce-reg-admin-privesc/Info severity — web · CVE-2026-54807. Status: PoC. Affects: WordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*). Tags: wordpress, woocommerce, privilege-escalation, registration-form, admin-takeover, broken-access-control.webInfowordpresswoocommerceprivilege-escalationregistration-formadmin-takeoverbroken-access-controlHippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10580-hippoo-woocommerce-authbypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-10580-hippoo-woocommerce-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-10580. Status: Weaponized. Affects: Hippoo Mobile App for WooCommerce (WordPress plugin). Tags: wordpress, plugin, woocommerce, hippoo, authentication-bypass, account-takeover, rest-api, unauthenticated.webCriticalwordpresspluginwoocommercehippooauthentication-bypassaccount-takeoverrest-apiunauthenticated