CVE-2025-13156 is an arbitrary file upload vulnerability in the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress, present in all versions up to 3.3.0. The vulnerability arises because the insert_media_attachment() function, called by save_update_category_img(), does not validate file types when processing category images. This allows authenticated users with subscriber-level privileges or higher to upload files of any type to the server, which can lead to remote code execution. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently available, and no known exploits in the wild have been reported.

An attacker with subscriber-level access or higher can upload arbitrary files to the affected WordPress site, potentially enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8, indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict user roles that can upload files, especially limiting subscriber-level users from uploading category images. Monitoring for suspicious file uploads and applying strict file type validation via third-party security plugins may help mitigate risk temporarily.