CVE-2025-11724

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11724", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T20:49:35.201Z", "datePublished": "2025-11-04T04:27:18.321Z", "dateUpdated": "2026-04-08T17:01:33.754Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:33.754Z"}, "affected": [{"vendor": "erinmorelli", "product": "EM Beer Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data."}], "title": "EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/76b7a946-71ad-46da-95f6-a02703812938?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L867"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L899"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L912"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/embm-admin-actions.php#L393"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "timeline": [{"time": "2025-11-03T15:34:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T16:32:35.452489Z", "id": "CVE-2025-11724", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T16:32:44.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-04T16:32:35.452489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T16:32:41.404Z"}}], "cna": {"title": "EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "erinmorelli", "product": "EM Beer Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:34:22.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/76b7a946-71ad-46da-95f6-a02703812938?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L867"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L899"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L912"}, {"url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/embm-admin-actions.php#L393"}], "descriptions": [{"lang": "en", "value": "The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:33.754Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11724", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:33.754Z", "dateReserved": "2025-10-13T20:49:35.201Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:18.321Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EM Beer Manager", "vendor": "erinmorelli", "versions": [{"lessThanOrEqual": "3.2.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data."}, {"lang": "es", "value": "El plugin EM Beer Manager para WordPress es vulnerable a la carga arbitraria de archivos, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo en todas las versiones hasta la 3.2.3, inclusive. Esto se debe a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n EMBM_Admin_Untappd_Import_image() y a la falta de comprobaciones de autorizaci\u00f3n en la acci\u00f3n wp_ajax_embm-untappd-import. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, carguen archivos arbitrarios, incluyendo archivos PHP, y ejecuten c\u00f3digo en el servidor, siempre que puedan proporcionar un servidor HTTP simulado que responda con datos JSON espec\u00edficos."}], "id": "CVE-2025-11724", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11724", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T16:32:35.452489Z", "version": "2.0.3"}}]}, "published": "2025-11-04T05:15:56.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/embm-admin-actions.php#L393"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L867"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L899"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L912"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/76b7a946-71ad-46da-95f6-a02703812938?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:32:37.818524+00:00", "value": {"mitigation_remediation": ["Update the EM Beer Manager plugin to the latest version that removes the vulnerable upload feature and implements proper file\u2011type validation.", "If an immediate update is not possible, temporarily disable or uninstall the Untappd integration to block the wp_ajax_embm-untappd-import AJAX endpoint for non\u2011administrator users.", "Reduce the capabilities of the subscriber role (or any role that can access the import page) so that only administrators can perform the upload, or remove the upload capability entirely."], "summary": {"action": "Patch Immediately", "impact": "Remote code execution via authenticated file upload"}, "threat_synthesis": {"affected_systems": "WordPress sites running the EM Beer Manager plugin version 3.2.3 or earlier, maintained by Erin Morelli. Versions up to and including 3.2.3 are impacted; sites using any newer release are presumed unaffected.", "description_and_impact": "The EM Beer Manager plugin for WordPress contains a flaw where the EMBM_Admin_Untappd_Import_image() function does not validate the type of files that can be uploaded, and the accompanying AJAX endpoint lacks proper authorization checks. This allows a user with subscriber-level access or higher to upload any file, including PHP scripts, and subsequently execute code on the web server, assuming the attacker can supply a mock HTTP server that returns the expected JSON payload. The vulnerability therefore enables remote code execution for authenticated users.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Because an attacker must be authenticated and possess at least subscriber privileges\u2014and must also coordinate a mock HTTP server that provides specific JSON data\u2014the attack vector is authenticated remote code execution with non\u2011trivial prerequisites, reducing its ease of exploitation."}}}}, "created": "2025-11-04T16:33:10.598564+00:00", "updated": "2026-04-22T12:45:17.019601+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}