What is the CVSS score of CVE-2025-5395?

CVE-2025-5395 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2025-5395?

The WordPress Automatic Plugin contains a critical file upload vulnerability that allows authenticated users with Author-level access to upload malicious files and potentially execute code on your…

How to fix or mitigate CVE-2025-5395?

Within 24 hours: Audit all user accounts with Author-level or higher permissions and review recent file uploads for suspicious activity. Within 7 days: Disable the WordPress Automatic Plugin entirely until a patch is released, or restrict plugin functionality through code modifications if business operations depend on it. Within 30 days: Monitor vendor security announcements for patch availability and implement a formal policy review for plugin permissions and access controls.

PHP CVE-2025-5395

EUVD-2025-18086 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-11 security@wordfence.com

WordPress RCE PHP Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18086

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 07:15 nvd

HIGH 8.8

DescriptionCVE.org

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

The WordPress Automatic Plugin (all versions up to 3.115.0) contains an arbitrary file upload vulnerability in core.php due to insufficient file type validation, allowing authenticated attackers with Author-level or higher privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a widely-deployed WordPress plugin; real-world exploitation requires valid WordPress credentials at Author level or above, but successful exploitation enables complete server compromise.

Technical ContextAI

The vulnerability exists in the WordPress Automatic Plugin, a content automation and scheduling plugin for WordPress (CPE: wp:automatic). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), stemming from inadequate file type validation in the core.php file. The plugin fails to properly validate file extensions or MIME types before accepting uploaded files, allowing an attacker to bypass file type restrictions. Unlike unauthenticated arbitrary file upload vulnerabilities, this requires valid WordPress user credentials with Author capability (post authoring/publishing permissions) or above, reducing the immediate attack surface but still representing significant risk in multi-user WordPress environments, agency/client sites, or compromised low-privilege accounts.