Cyber Posture

CVE-2025-12181

High

Published: 05 December 2025

Published
05 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and…

more

above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of the specific flaw in the ContentStudio plugin's cstu_update_post() function by applying patches to versions beyond 1.3.7.

SI-10 Information Input Validation good match
prevent

Mandates validation of file inputs at upload points to enforce missing file type checks and block arbitrary file uploads.

CM-11 User-installed Software partial match
prevent

Restricts user installation of unapproved plugins like ContentStudio, preventing deployment of vulnerable versions on WordPress sites.

Security SummaryAI

CVE-2025-12181 is an arbitrary file upload vulnerability in the ContentStudio plugin for WordPress, stemming from missing file type validation in the cstu_update_post() function. It affects all versions up to and including 1.3.7 and has been mapped to CWE-434 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CVE-2025-67910 is likely a duplicate of this issue.

Authenticated attackers with Author-level access or higher can exploit the vulnerability over the network with low complexity and no user interaction required. By uploading arbitrary files to the affected site's server, they can potentially achieve remote code execution, granting high levels of confidentiality, integrity, and availability impact.

Advisories from Wordfence and the WordPress plugin repository detail mitigation steps, including a patch committed in changeset 3412182 at plugins.trac.wordpress.org. Security practitioners should urge site administrators to update the ContentStudio plugin beyond version 1.3.7 via wordpress.org/plugins/contentstudio/.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload in WordPress plugin enables exploitation of public-facing application (T1190) and deployment of web shells for RCE (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References