WordPress CVE-2025-12968
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the upload_file function in the infility_import_file class only validating the MIME type which can be easily spoofed, and the import_data function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
AnalysisAI
Authenticated arbitrary file upload in Infility Global WordPress plugin versions ≤2.14.42 permits remote code execution. The upload_file function accepts spoofed MIME types without verifying file extensions, while import_data lacks capability checks, allowing subscriber-level users to upload malicious files (e.g., PHP webshells) to the server. CVSS:3.1 score 8.8 (High) reflects network-accessible, low-complexity exploitation requiring only low-privilege authentication. No public exploit identified at time of analysis. EPSS 0.35% indicates low observed exploitation activity.
Technical ContextAI
Root cause: CWE-434 insufficient file type validation. The infility_import_file class validates only client-controlled MIME type headers, ignoring file extension/content verification. Missing capability checks in import_data allow privilege escalation from subscriber (lowest authenticated role) to arbitrary file write. CVSS vector PR:L confirms authenticated requirement; network vector (AV:N) and no user interaction (UI:N) enable direct exploitation.
Affected ProductsAI
Infility Global plugin for WordPress, versions 2.14.42 and earlier. Vendor: Infility. CPE applicability: WordPress installations with subscriber-level user registration enabled.
RemediationAI
Upgrade to Infility Global version 2.14.43 or later, which addresses the file upload validation and capability check deficiencies per upstream commit (https://plugins.trac.wordpress.org/changeset?old=3421596%40infility-global&new=3421596%40infility-global). Workaround: restrict user registration to prevent untrusted subscriber accounts, implement web application firewall rules blocking executable file uploads to wp-content directories, or deactivate the plugin until upgrade is feasible. Verify patched version behavior in staging before production deployment. Full vendor advisory and technical analysis available at https://www.wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=cve. Post-upgrade, audit user accounts with subscriber privileges and review server logs for suspicious upload activity to /wp-content/uploads or plugin-specific directories during exposure window.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today