CVE-2025-13376

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13376", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T19:29:31.740Z", "datePublished": "2025-11-25T07:28:21.417Z", "dateUpdated": "2026-04-08T17:01:49.616Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:49.616Z"}, "affected": [{"vendor": "ov3rkll", "product": "ProjectList", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L27"}, {"url": "https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L27"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-11-24T19:12:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T15:01:23.216135Z", "id": "CVE-2025-13376", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:01:33.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T15:01:23.216135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:01:27.390Z"}}], "cna": {"title": "ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ov3rkll", "product": "ProjectList", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:12:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L27"}, {"url": "https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L27"}], "descriptions": [{"lang": "en", "value": "The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:49.616Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13376", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:49.616Z", "dateReserved": "2025-11-18T19:29:31.740Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:21.417Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ProjectList", "vendor": "ov3rkll", "versions": [{"lessThanOrEqual": "0.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin ProjectList para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en todas las versiones hasta la 0.3.0, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Editor o superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-13376", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13376", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T15:01:23.216135Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:49.877", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L27"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L27"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:25:57.951562+00:00", "value": {"mitigation_remediation": ["Upgrade the ProjectList plugin to a version newer than 0.3.0 as soon as an official patch is available.", "If an upgrade is not yet possible, temporarily deactivate the ProjectList plugin or remove the upload functionality until a fix is released.", "Restrict the upload capability by ensuring that only Administrators, not Editors, can add files, and configure the server to prevent execution of files in upload directories."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "This vulnerability afflicts the ProjectList plugin by the vendor ov3rkll, specifically all releases up to and including version 0.3.0. Site owners running any of these affected plugin releases are at risk.", "description_and_impact": "The ProjectList plugin for WordPress contains a missing file type validation flaw that allows authenticated users with Editor-level access or higher to upload any file to the site\u2019s server. An attacker who can place a malicious script in the uploaded file could achieve remote code execution on the host, compromising confidentiality, integrity and availability of the web application and underlying operating system.", "risk_and_exploitability": "The vulnerability scores a CVSS 7.2, indicating a high level of severity. The EPSS score is below 1\u202f%, suggesting that currently the likelihood of exploitation is low, and the issue is not listed in CISA\u2019s KEV catalog. Because it requires authenticated access with Editor or higher privileges, the attack vector is internal or through compromised credentials. Once an attacker uploads a malicious payload, the lack of file type filtering can allow code execution if the uploaded file is placed in a writable directory that is served by the web server."}}}}, "created": "2025-11-26T11:11:11.165449+00:00", "updated": "2026-04-22T00:30:04.052603+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}