Cyber Posture

CVE-2025-12154

High

Published: 05 December 2025

Published
05 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 39.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access…

more

and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mandates validation of information inputs like file uploads to enforce file type restrictions, addressing the core missing validation in uploadThumb().

SI-2 Flaw Remediation good match
prevent

Ensures timely identification, reporting, and remediation of the specific flaw in the Auto Thumbnailer plugin, preventing exploitation via patching.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict Contributor-level users from accessing upload functions if not essential, reducing the authenticated attack surface.

Security SummaryAI

CVE-2025-12154 affects the Auto Thumbnailer plugin for WordPress, specifically due to missing file type validation in the uploadThumb() function across all versions up to and including 1.0. This flaw enables arbitrary file uploads, as documented in the CVE published on 2025-12-05. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By uploading arbitrary files to the affected WordPress site's server, they may achieve remote code execution, granting high levels of confidentiality, integrity, and availability impact.

For mitigation details, refer to advisories from the plugin page at https://wordpress.org/plugins/auto-thumbnailer/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c98191-bf17-4e94-88cc-ad385b1fe97d?source=cve.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload in WordPress plugin enables exploitation of public-facing application (T1190) and facilitates web shell deployment for RCE (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References