CVE-2025-11889

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11889", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-16T18:48:53.653Z", "datePublished": "2025-10-24T08:24:00.896Z", "dateUpdated": "2026-04-08T16:59:31.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:31.699Z"}, "affected": [{"vendor": "edgarrojas", "product": "AIO Forms \u2013 Craft Complex Forms Easily", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.18", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AIO Forms \u2013 Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.18. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc69491-0f40-4bab-9215-b25f72110e26?source=cve"}, {"url": "https://wordpress.org/plugins/all-in-one-forms/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3400661%40all-in-one-forms&new=3400661%40all-in-one-forms&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "timeline": [{"time": "2025-10-23T20:07:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T12:12:26.651063Z", "id": "CVE-2025-11889", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:30:41.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-24T12:12:26.651063Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:12:27.476Z"}}], "cna": {"title": "AIO Forms <= 1.3.15 - Authenticated (Admin+) Arbitrary File Upload via Zip Import", "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "edgarrojas", "product": "AIO Forms \u2013 Craft Complex Forms Easily", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-23T20:07:43.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc69491-0f40-4bab-9215-b25f72110e26?source=cve"}, {"url": "https://wordpress.org/plugins/all-in-one-forms/"}], "descriptions": [{"lang": "en", "value": "The AIO Forms \u2013 Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.15. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-24T08:24:00.896Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11889", "state": "PUBLISHED", "dateUpdated": "2025-10-24T12:30:41.769Z", "dateReserved": "2025-10-16T18:48:53.653Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-24T08:24:00.896Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AIO Forms \u2013 Craft Complex Forms Easily", "vendor": "edgarrojas", "versions": [{"lessThanOrEqual": "1.3.18", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AIO Forms \u2013 Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.18. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin AIO Forms - Craft Complex Forms Easily para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en la funcionalidad de importaci\u00f3n en todas las versiones hasta la 1.3.15, inclusive. Esto permite a atacantes autenticados, con acceso de nivel de Administrador y superior, cargar archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-11889", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11889", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-24T12:12:26.651063Z", "version": "2.0.3"}}]}, "published": "2025-10-24T09:15:43.353", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3400661%40all-in-one-forms&new=3400661%40all-in-one-forms&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/all-in-one-forms/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc69491-0f40-4bab-9215-b25f72110e26?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:46:46.583156+00:00", "value": {"mitigation_remediation": ["Update the AIO Forms plugin to any version newer than 1.3.18 so that the file type validation is restored.", "If an upgrade cannot be applied immediately, disable the zip import feature for all but the most trusted administrators, or remove it entirely from the plugin configuration.", "As a temporary safeguard, configure the web server or the plugin to store uploaded files outside the web\u2011accessible directory and enforce strict MIME type checks so that uploaded files cannot be executed."], "summary": {"action": "Immediate Patch", "impact": "Potential remote code execution via arbitrary file upload"}, "threat_synthesis": {"affected_systems": "WordPress sites using the AIO Forms \u2013 Craft Complex Forms Easily plugin versions 1.3.18 and earlier are affected. Administrators or users with higher privileges on these sites can exploit the weakness.", "description_and_impact": "The AIO Forms plugin for WordPress allows administrators to import form configurations through a zip upload. The plugin lacks file type validation during import, enabling authenticated users with Administrator permissions to upload files of any type. This flaw, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), can be leveraged to place malicious code on the web server, potentially leading to remote code execution.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high impact vulnerability. However, the EPSS score is below 1%, suggesting a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need administrator access and the ability to navigate to the import function to upload a crafted file; no external interface is required. Once uploaded, malicious files could be executed by accessing them through the web server, giving attackers code execution capabilities."}}}}, "created": "2025-10-27T22:13:10.718970+00:00", "updated": "2026-04-22T17:00:12.303993+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}