CVE-2025-12528

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12528", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T17:43:52.699Z", "datePublished": "2025-11-18T08:27:31.375Z", "dateUpdated": "2026-04-08T16:50:26.537Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:26.537Z"}, "affected": [{"vendor": "genetechproducts", "product": "Pie Forms \u2014 Drag & Drop Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. This is due to insufficient file type validation where the validate_classic method validates file extensions and sets error messages but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers to upload files with dangerous extensions such as PHP, which makes remote code execution possible. In order to exploit this vulnerability, the attacker needs to guess the directory in which the file is placed (which is a somewhat predictable hash). In addition to that, the file name is generated using a secure hash method, limiting the exploitability of this vulnerability."}], "title": "Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L331"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L475"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L18"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Le Viet Anh"}], "timeline": [{"time": "2025-11-17T20:08:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T16:03:23.530780Z", "id": "CVE-2025-12528", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:03:31.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12528", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T16:03:23.530780Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:03:26.678Z"}}], "cna": {"title": "Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Le Viet Anh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "genetechproducts", "product": "Pie Forms \u2014 Drag & Drop Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:08:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L331"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L475"}, {"url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L18"}], "descriptions": [{"lang": "en", "value": "The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. This is due to insufficient file type validation where the validate_classic method validates file extensions and sets error messages but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers to upload files with dangerous extensions such as PHP, which makes remote code execution possible. In order to exploit this vulnerability, the attacker needs to guess the directory in which the file is placed (which is a somewhat predictable hash). In addition to that, the file name is generated using a secure hash method, limiting the exploitability of this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:26.537Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12528", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:26.537Z", "dateReserved": "2025-10-30T17:43:52.699Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:31.375Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pie Forms \u2014 Drag & Drop Form Builder", "vendor": "genetechproducts", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. This is due to insufficient file type validation where the validate_classic method validates file extensions and sets error messages but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers to upload files with dangerous extensions such as PHP, which makes remote code execution possible. In order to exploit this vulnerability, the attacker needs to guess the directory in which the file is placed (which is a somewhat predictable hash). In addition to that, the file name is generated using a secure hash method, limiting the exploitability of this vulnerability."}, {"lang": "es", "value": "El plugin Pie Forms for WP para WordPress es vulnerable a la Carga Arbitraria de Archivos en todas las versiones hasta la 1.6, inclusive, a trav\u00e9s de la funci\u00f3n 'format_classic'. Esto se debe a una validaci\u00f3n insuficiente del tipo de archivo, donde el m\u00e9todo 'validate_classic' valida las extensiones de archivo y establece mensajes de error, pero no evita que el proceso de carga de archivos contin\u00fae. Esto permite a atacantes no autenticados cargar archivos con extensiones peligrosas como PHP, lo que hace posible la ejecuci\u00f3n remota de c\u00f3digo. Para explotar esta vulnerabilidad, el atacante necesita adivinar el directorio donde se coloca el archivo (que es un hash algo predecible). Adem\u00e1s de eso, el nombre del archivo se genera utilizando un m\u00e9todo de hash seguro, lo que limita la explotabilidad de esta vulnerabilidad."}], "id": "CVE-2025-12528", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12528", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T16:03:23.530780Z", "version": "2.0.3"}}]}, "published": "2025-11-18T09:15:48.710", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L18"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L331"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L475"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:32:26.161089+00:00", "value": {"mitigation_remediation": ["Upgrade the Pie Forms for WP plugin to a version newer than 1.6; if no update is available, uninstall the plugin entirely.", "Disable the file upload functionality in Pie Forms for WP or restrict form access to authenticated users only, thereby eliminating the unauthenticated upload vector.", "Configure the web server or application firewall to deny execution of files placed in the upload directory, or block PHP execution for uploaded files with risky extensions."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability targets the Pie Forms \u2014 Drag & Drop Form Builder developed by genetechproducts for WordPress. Any WordPress site running the plugin in version 1.6 or earlier is susceptible, particularly the file upload field provided by the plugin. The attack requires no authentication, making all sites with the vulnerable plugin a potential target.", "description_and_impact": "The Pie Forms for WP plugin contains an insufficient file type validation flaw that allows an unauthenticated attacker to upload files with dangerous extensions such as PHP through the format_classic function. The validate_classic method only checks extensions and sets an error message but continues the upload process, enabling the attacker to place a malicious file on the server. If such a file is executed, the attacker can run arbitrary code on the hosting web server, effectively compromising the entire WordPress site.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, suggesting exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is unauthenticated form submission, and the upload directory is a somewhat predictable hash while the file name is hashed, reducing but not eliminating the risk of remote code execution."}}}}, "created": "2025-11-19T10:48:10.204102+00:00", "updated": "2026-04-22T00:45:04.148713+00:00", "vendors": ["genetechproducts", "genetechproducts$PRODUCT$pie_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}