The vulnerability CVE-2025-60219 in HaruTheme WooCommerce Designer Pro allows an attacker to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the affected server. The issue affects all versions up to and including 1.9.24. The CVSS 3.1 score of 10.0 reflects the critical nature of this vulnerability, with an attacker able to exploit it remotely without authentication or user interaction, resulting in full compromise of confidentiality, integrity, and availability of the system.

Successful exploitation of this vulnerability allows an attacker to upload a web shell to the server hosting WooCommerce Designer Pro, leading to remote code execution. This can result in complete system compromise, including unauthorized access to sensitive data, modification or deletion of data, and disruption of service. The vulnerability is critical and can be exploited remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting file upload functionality in WooCommerce Designer Pro if possible, and monitor for suspicious activity related to file uploads. Applying strict web server and application-level controls to limit file types and upload locations may reduce risk but is not a complete mitigation. Stay updated with HaruTheme advisories for an official patch or temporary fix.