A critical security vulnerability in the popular TI WooCommerce Wishlist plugin has left over 100,000 WordPress websites exposed to potential cyberattacks, with security researchers warning of imminent exploitation risks.

The vulnerability, designated as CVE-2025-47577 and assigned the maximum CVSS score of 10.0, enables unauthenticated attackers to upload arbitrary files to affected websites, potentially leading to complete server compromise.

The TI WooCommerce Wishlist plugin, which adds wishlist functionality to WooCommerce stores, has become a significant security liability for e-commerce websites worldwide.

The vulnerability specifically affects version 2.9.2 and all previous versions, with no patched release currently available from the plugin developers.

This security flaw represents one of the most severe WordPress plugin vulnerabilities discovered in recent months, given its widespread deployment and the severity of potential attacks.

Patchstack analysts identified this critical vulnerability during routine security assessments and immediately attempted to contact the plugin vendor on March 26, 2025.

However, after receiving no response from the developers for nearly two months, the security firm proceeded to publish the vulnerability details to their database on May 16, 2025, followed by a public advisory on May 27, 2025.

The lack of vendor response has left website administrators with limited options beyond completely removing the plugin from their installations.

Technical Infection Mechanism

The vulnerability stems from a fundamental flaw in the plugin’s file upload handling mechanism, specifically within the tinvwl_upload_file_wc_fields_factory function.

This function processes file uploads through WordPress’s native wp_handle_upload function but deliberately disables critical security validations that would normally prevent malicious file uploads.

The problematic code demonstrates a dangerous configuration that bypasses WordPress’s built-in security measures:-

function tinvwl_upload_file_wc_fields_factory( $file ) {
    if (!function_exists( 'wp_handle_upload' ) ) {
        require_once( ABSPATH . 'wp-admin/includes/file.php' );
    }
    $upload = wp_handle_upload(
        $file,
        [
            'test_form' => false,
            'test_type' => false,
        ]
    );
    return $upload;
}

The critical security failure occurs through the 'test_type' => false parameter, which explicitly disables file type validation that would normally restrict uploads to safe file types.

This configuration allows attackers to upload executable PHP files directly to the server, which can then be accessed and executed remotely to achieve complete system compromise.

The vulnerability is only exploitable when the WC Fields Factory plugin is simultaneously active, creating a specific attack vector that affects a subset of the plugin’s user base.

Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here

The post WordPress TI WooCommerce Wishlist Plugin Vulnerability Exposes 100,000+ Websites To Cyberattack appeared first on Cyber Security News.