CVE-2023-25970 CRITICAL

CVE-2023-25970: WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Vendor Zendrop
Product Zendrop – Global Dropshipping
Weakness CWE-434 · Unrestricted file upload
Published December 20, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

Zendrop – Global Dropshipping versions up to 1.0.0 allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files to the server over the network without needing credentials or user interaction. This can lead to remote code execution, data theft, or site takeover.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the server and execute code without authentication.

Potential impact on your site

04Site Impact

Attackers can run arbitrary code, steal data, or take full control of the site.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 20, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability CVE-2026-9009 Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute CVE-2026-14270 Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings CVE-2026-14282 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2