Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-12673. PoCs published by d0n601.
AI-analyzed exploit summary The repository provides a functional exploit for CVE-2025-12673, demonstrating an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator WordPress plugin. The exploit leverages the `update_qr_code` AJAX endpoint to upload a malicious PHP file, leading to remote code execution.
Description
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (1)
The repository provides a functional exploit for CVE-2025-12673, demonstrating an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator WordPress plugin. The exploit leverages the `update_qr_code` AJAX endpoint to upload a malicious PHP file, leading to remote code execution.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H