Nexter Blocks CVE-2025-15678

Exploitation requires the attacker to possess a valid WordPress account with the upload_files capability - the Author role holds this by default. The victim (typically a higher-privileged user such as an Editor or Administrator) must access the uploaded SVG file via its direct URL in a browser; embedding the SVG via an <img> tag is insufficient for script execution in most modern browsers, but a direct URL request causes the browser to parse SVG as XML and execute inline scripts. Sites that disable file uploads for all roles below Editor, block SVG MIME types at the server or application layer, or that do not permit Author-level account registrations from untrusted users are not exploitable. The CVSS vector PR:N conflicts with the authentication requirement described - the actual exploitation condition is PR:L (authenticated, low-privilege account), which defenders should use when assessing realistic exposure.

The NVD CVSS 3.1 score of 6.1 (Medium) is assigned with PR:N, which directly contradicts the description stating exploitation requires a user 'able to upload files (Author by default)' - a clear authenticated precondition. This inflation of the apparent attack vector is a notable discrepancy; the corrected assessment with PR:L yields a lower effective severity. EPSS at 0.15% (5th percentile) confirms very low observed exploitation probability, and the vulnerability is absent from CISA KEV, meaning no confirmed active exploitation. The SSVC framework rates automatable as 'no' - consistent with the social-engineering step of directing a victim to load the SVG - and technical impact as 'partial,' appropriate for session-scoped XSS without direct server compromise. The public WPScan POC lowers the skill barrier to exploitation, making this a realistic threat specifically in multi-tenant WordPress environments, editorial platforms, or sites permitting Author-level registrations from untrusted parties. Against sites with tightly controlled Author accounts, real-world risk is substantially lower than the raw CVSS score implies.

An attacker who holds or registers a WordPress Author account crafts an SVG file with an embedded <script> block that exfiltrates the victim's session cookie to an attacker-controlled endpoint. The attacker uploads the SVG through the WordPress media library and socially engineers a site administrator into clicking the direct SVG URL - for example, by embedding it in a support message or internal link. When the administrator's browser loads the SVG from the WordPress domain, the script executes same-origin, enabling session token theft and potential administrative account takeover. A public proof-of-concept for this technique is available via WPScan.