CVE-2025-12057
CRITICAL EXPLOITEDWavePlayer WP <3.8.0 - Unauthenticated RCE
Title source: llmExploitation Summary
CVE-2025-12057 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including adminlove520, DeadExpl0it.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-12057, targeting an unauthenticated arbitrary file upload vulnerability in the WordPress WavePlayer plugin (< 3.8.0). The exploit automates the process of uploading a malicious PHP payload to achieve remote code execution (RCE).
Description
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
Exploits (2)
This repository contains a functional Python exploit for CVE-2025-12057, targeting an unauthenticated arbitrary file upload vulnerability in the WordPress WavePlayer plugin (< 3.8.0). The exploit automates the process of uploading a malicious PHP payload to achieve remote code execution (RCE).
This repository contains a functional exploit for CVE-2025-12057, an unauthenticated arbitrary file upload vulnerability in the WordPress WavePlayer plugin (< 3.8.0). The exploit uploads a malicious PHP payload to achieve remote code execution (RCE).
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H