What is the CVSS score of CVE-2025-12968?

CVE-2025-12968 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WordPress are affected by CVE-2025-12968?

The Infility Global WordPress plugin (versions ≤2.14.42) contains a critical authenticated file upload vulnerability allowing low-privilege subscriber accounts to upload and execute malicious PHP…

How to fix or mitigate CVE-2025-12968?

Within 24 hours: Identify all WordPress installations using Infility Global plugin and document current version numbers; disable the plugin immediately if version ≤2.14.42 is detected. Within 7 days: Review user role assignments to restrict subscriber-level accounts and audit upload directories for suspicious PHP files; implement Web Application Firewall rules to block PHP uploads to wp-content/uploads. Within 30 days: Contact Infility Global for patch availability status; evaluate alternative plugins with equivalent functionality; perform full site malware scan if high subscriber user count exists.

WordPress CVE-2025-12968

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-12-12 security@wordfence.com

RCE WordPress File Upload

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the upload_file function in the infility_import_file class only validating the MIME type which can be easily spoofed, and the import_data function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Authenticated arbitrary file upload in Infility Global WordPress plugin versions ≤2.14.42 permits remote code execution. The upload_file function accepts spoofed MIME types without verifying file extensions, while import_data lacks capability checks, allowing subscriber-level users to upload malicious files (e.g., PHP webshells) to the server. CVSS:3.1 score 8.8 (High) reflects network-accessible, low-complexity exploitation requiring only low-privilege authentication. No public exploit identified at time of analysis. EPSS 0.35% indicates low observed exploitation activity.

Technical ContextAI

Root cause: CWE-434 insufficient file type validation. The infility_import_file class validates only client-controlled MIME type headers, ignoring file extension/content verification. Missing capability checks in import_data allow privilege escalation from subscriber (lowest authenticated role) to arbitrary file write. CVSS vector PR:L confirms authenticated requirement; network vector (AV:N) and no user interaction (UI:N) enable direct exploitation.

Affected ProductsAI

Infility Global plugin for WordPress, versions 2.14.42 and earlier. Vendor: Infility. CPE applicability: WordPress installations with subscriber-level user registration enabled.

RemediationAI

Upgrade to Infility Global version 2.14.43 or later, which addresses the file upload validation and capability check deficiencies per upstream commit (https://plugins.trac.wordpress.org/changeset?old=3421596%40infility-global&new=3421596%40infility-global). Workaround: restrict user registration to prevent untrusted subscriber accounts, implement web application firewall rules blocking executable file uploads to wp-content directories, or deactivate the plugin until upgrade is feasible. Verify patched version behavior in staging before production deployment. Full vendor advisory and technical analysis available at https://www.wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=cve. Post-upgrade, audit user accounts with subscriber privileges and review server logs for suspicious upload activity to /wp-content/uploads or plugin-specific directories during exposure window.