CVE-2025-12775
Published: 18 November 2025
Description
The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_handle` function. This is due to the chunked upload functionality writing files directly to the uploads directory…
more
before any file type validation occurs. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of file uploads prior to writing to disk, addressing the core flaw where chunked uploads bypass type validation in ajax_upload_handle.
Requires timely identification, reporting, and patching of flaws like this arbitrary file upload vulnerability in the WP Dropzone plugin.
Restricts file types, sizes, and characteristics allowable in uploads to the server's uploads directory, preventing arbitrary dangerous files from being accepted.
Security SummaryAI
CVE-2025-12775 is an authenticated arbitrary file upload vulnerability in the WP Dropzone plugin for WordPress, affecting all versions up to and including 1.1.0. The flaw resides in the `ajax_upload_handle` function, where the chunked upload functionality writes files directly to the uploads directory before performing any file type validation. Published on 2025-11-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By leveraging the chunked upload mechanism, they can upload arbitrary files to the server's uploads directory, potentially enabling remote code execution on the affected WordPress site.
Advisories and references, including the Wordfence threat intelligence report and WordPress plugin trac entries, highlight the vulnerable code in `includes/class-plugin.php` at lines 88 and 127, along with a specific changeset (3395966) that may indicate remediation efforts. Security practitioners should review these sources for patching guidance and update to a fixed version if available.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and facilitates web shell deployment for RCE (T1505.003).