CVE-2025-11087
Published: 21 November 2025
Description
The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This…
more
makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of information inputs such as CSRF nonces and file types, directly preventing forged requests and arbitrary file uploads exploited in this CVE.
Provides mechanisms like challenge-response to protect session authenticity, mitigating CSRF attacks that trick administrators into uploading malicious files.
Mandates timely identification, reporting, and correction of flaws like the missing validations in this WordPress plugin CVE, preventing exploitation through patching.
Security SummaryAI
CVE-2025-11087 is a Cross-Site Request Forgery (CSRF) vulnerability leading to arbitrary file upload in the Zegen Core plugin for WordPress, affecting versions up to and including 2.0.1. The issue stems from missing nonce validation and file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. Published on 2025-11-21, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-352 (Cross-Site Request Forgery).
Unauthenticated attackers can exploit this vulnerability by crafting a forged request and tricking a site administrator into performing an action, such as clicking a malicious link. Successful exploitation allows the upload of arbitrary files to the affected site's server, which may enable remote code execution.
Mitigation details are available in advisories such as the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/145deebd-1e15-4f8a-878c-9424c2cd9601?source=cve, with the plugin distributed via its ThemeForest page at https://themeforest.net/item/zegen-church-wordpress-theme/25116823.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing WordPress plugin (T1190) via CSRF for arbitrary file upload, facilitating web shell deployment for RCE (T1100).