CVE-2025-12968
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Analysis
Authenticated arbitrary file upload in Infility Global WordPress plugin versions ≤2.14.42 permits remote code execution. The upload_file function accepts spoofed MIME types without verifying file extensions, while import_data lacks capability checks, allowing subscriber-level users to upload malicious files (e.g., PHP webshells) to the server. CVSS:3.1 score 8.8 (High) reflects network-accessible, low-complexity exploitation requiring only low-privilege authentication. No public exploit identified at time of analysis. EPSS 0.35% indicates low observed exploitation activity.
Technical Context
Root cause: CWE-434 insufficient file type validation. The infility_import_file class validates only client-controlled MIME type headers, ignoring file extension/content verification. Missing capability checks in import_data allow privilege escalation from subscriber (lowest authenticated role) to arbitrary file write. CVSS vector PR:L confirms authenticated requirement; network vector (AV:N) and no user interaction (UI:N) enable direct exploitation.
Affected Products
Infility Global plugin for WordPress, versions 2.14.42 and earlier. Vendor: Infility. CPE applicability: WordPress installations with subscriber-level user registration enabled.
Remediation
Upgrade to Infility Global version 2.14.43 or later, which addresses the file upload validation and capability check deficiencies per upstream commit (https://plugins.trac.wordpress.org/changeset?old=3421596%40infility-global&new=3421596%40infility-global). Workaround: restrict user registration to prevent untrusted subscriber accounts, implement web application firewall rules blocking executable file uploads to wp-content directories, or deactivate the plugin until upgrade is feasible. Verify patched version behavior in staging before production deployment. Full vendor advisory and technical analysis available at https://www.wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=cve. Post-upgrade, audit user accounts with subscriber privileges and review server logs for suspicious upload activity to /wp-content/uploads or plugin-specific directories during exposure window.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today