7.3
High
CVE-2025-12835 The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any…
Description
The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WooMulti 1.7 | earliest → 1.7 | No fix stated |