The vulnerability CVE-2025-49885 affects the HaruTheme Drag and Drop Multiple File Upload (Pro) plugin for WooCommerce, allowing attackers to upload files with dangerous types without restriction. This includes the ability to upload web shells, which can be executed on the server, leading to full system compromise. The issue affects all versions up to and including 5.0.6. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server hosting the vulnerable plugin. This can result in full system compromise, data theft, data modification, and denial of service. The vulnerability poses a critical risk to affected WooCommerce installations using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.