CVE-2025-5395

HIGH

WordPress Automatic Plugin <3.115.0 - File Upload

Title source: llm

Description

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

References (2)

[Various Sources] https://codecanyon.net/item/wordpress-automatic-plugin/1904470#item-description__changelog

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=cve

Scores

CVSS v3 8.8

EPSS 0.0051

EPSS Percentile 65.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-434

Status draft

Timeline

Published Jun 11, 2025

Tracked Since Feb 18, 2026