What is the CVSS score of CVE-2025-6086?

CVE-2025-6086 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by CVE-2025-6086?

The CSV Me WordPress plugin contains a critical file upload vulnerability affecting all versions through 2.0 that could allow administrative users to upload malicious files and potentially execute…

How to fix or mitigate CVE-2025-6086?

Within 24 hours: Audit all administrator accounts for unauthorized access and review recent file uploads in the plugin directory. Within 7 days: Disable or remove the CSV Me plugin immediately if not actively required for business operations; if required, restrict administrator role assignments to only essential personnel and implement enhanced monitoring of uploads. Within 30 days: Migrate to an alternative CSV handling solution or await vendor patch availability; document all compensating controls implemented.

PHP CVE-2025-6086

EUVD-2025-18633 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-18 security@wordfence.com

WordPress RCE PHP

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18633

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

CVE Published

Jun 18, 2025 - 10:15 nvd

HIGH 7.2

DescriptionCVE.org

The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

The CSV Me WordPress plugin versions up to 2.0 contains an arbitrary file upload vulnerability in the 'csv_me_options_page' function due to insufficient file type validation. Authenticated administrators can exploit this to upload arbitrary files to the server, potentially enabling remote code execution. This is a post-authentication privilege abuse vulnerability with high impact on confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability exists in the CSV Me plugin for WordPress (CPE: wp:csv_me:*:*:*:*:*:*:*:*), specifically in the 'csv_me_options_page' function which handles file upload operations. The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating the plugin fails to properly validate file types before accepting uploads. This is a common WordPress plugin vulnerability pattern where server-side file type checks are either absent, bypassable (e.g., relying only on MIME type headers), or insufficiently restrictive. The vulnerability operates within the WordPress admin context where the upload functionality is typically accessed through the plugin's settings page, with file uploads likely processed through standard WordPress upload handlers without proper extension or content-type whitelisting.

RemediationAI

Update CSV Me plugin to a patched version above 2.0 immediately when available from the official WordPress plugin repository or vendor
If immediate patching is unavailable, disable the CSV Me plugin until a patch is released to eliminate exploitation surface
Implement strict file upload validation at the WordPress level by restricting administrator access to trusted users only and enabling two-factor authentication (2FA) for all admin accounts
Configure web server restrictions (e.g., Apache .htaccess, Nginx configuration) to prevent execution of uploaded files, particularly in plugin upload directories: disable PHP execution in wp-content/uploads and related directories
Monitor admin access logs and file uploads for suspicious activity, particularly uploads of executable file types (.php, .phtml, .php5, .exe, .sh, etc.)
Implement a Web Application Firewall (WAF) rule to detect and block uploads of executable files to the CSV Me plugin upload endpoint
Conduct a security audit of the WordPress installation to identify if any unauthorized files were uploaded, particularly in the plugins and uploads directories