Droip
CVE-2025-5831
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | High-severity RCE vector affecting authenticated WordPress users with Subscriber+ privileges. Network-accessible, low complexity exploitation enables arbitrary file uploads bypassing validation, directly enabling code execution. EPSS shows moderate observed exploitation activity. Priority for sites with untrusted subscriber accounts or permissive user roles. |
| Exploit ScenarioDerived | Authenticated attacker with Subscriber access calls make_google_font_offline() via WordPress admin or plugin interface, uploading PHP shell as font file. Server executes uploaded file, granting remote code execution. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Droip version 2.5.2. WordPress administrators must immediately upgrade to Droip 2.5.2 or later through the WordPress plugin dashboard or manual installation. If immediate patching is not feasible, deactivate the Droip plugin until upgrade completion to eliminate attack surface. Review user account permissions and revoke unnecessary Subscriber-level accounts. Audit server file systems for unauthorized uploads in WordPress upload directories and temporary file locations. Implement web application firewall rules to restrict file upload endpoints. Consult Wordfence threat intelligence advisory for additional indicators: https://www.wordfence.com/threat-intel/vulnerabilities/id/dd129829-9682-4def-a07f-66f9178eeb77?source=cve. Verify plugin authenticity through official repository: https://droip.com/.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-434 vulnerability stems from absent file type validation in make_google_font_offline() function. WordPress Subscriber role (lowest authenticated privilege tier) sufficient for exploitation. Network-accessible attack vector with low complexity (AC:L) requires no user interaction. CPE identifies Themeum Droip plugin for WordPress across all pre-patch versions.
Know when Droip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Executive ViewAI
Themeum Droip WordPress plugin versions up to 2.5.1 contain an arbitrary file upload vulnerability allowing authenticated subscribers to execute arbitrary code on affected servers. Any WordPress site running this plugin with user registration enabled faces immediate risk of complete server compromise through low-privileged account abuse.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable user registration on WordPress to eliminate attack surface; (2) Implement .htaccess rules blocking script execution in wp-content/uploads directory (php, exe, sh, asp extensions); (3) Restrict file upload functionality via file type whitelist at application level; (4) Monitor upload directories for suspicious executable files; (5) Implement web application firewall rules to block file uploads from low-privilege accounts if plugin functionality is required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Secur
GitHub PoC
Exploit-DB