CVE-2025-13597

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13597", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T07:35:20.877Z", "datePublished": "2025-11-25T22:28:37.000Z", "dateUpdated": "2026-04-08T17:20:47.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:47.429Z"}, "affected": [{"vendor": "soportecibeles", "product": "AI Feeds", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible."}], "title": "AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5007dd0-a62c-4ad8-8f8b-eb3f4387c370?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ai-feeds/trunk/actualizador_git.php#L1"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402321/ai-feeds"}, {"url": "https://github.com/d0n601/CVE-2025-13597"}, {"url": "https://ryankozak.com/posts/cve-2025-13597"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ryan Kozak"}], "timeline": [{"time": "2025-11-25T18:24:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-25T09:45:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-26T14:54:48.953212Z", "id": "CVE-2025-13597", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:54:58.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13597", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-26T14:54:48.953212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:54:54.988Z"}}], "cna": {"title": "AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Ryan Kozak"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "soportecibeles", "product": "AI Feeds", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-25T18:24:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-25T09:45:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5007dd0-a62c-4ad8-8f8b-eb3f4387c370?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ai-feeds/trunk/actualizador_git.php#L1"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402321/ai-feeds"}, {"url": "https://github.com/d0n601/CVE-2025-13597"}, {"url": "https://ryankozak.com/posts/cve-2025-13597"}], "descriptions": [{"lang": "en", "value": "The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:47.429Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13597", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:20:47.429Z", "dateReserved": "2025-11-24T07:35:20.877Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T22:28:37.000Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AI Feeds", "vendor": "soportecibeles", "versions": [{"lessThanOrEqual": "1.0.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin AI Feeds para WordPress es vulnerable a subidas arbitrarias de archivos debido a la falta de verificaci\u00f3n de capacidades en el archivo 'actualizador_git.php' en todas las versiones hasta la 1.0.11, inclusive. Esto permite que atacantes no autenticados descarguen repositorios arbitrarios de GitHub y sobrescriban archivos del plugin en el servidor del sitio afectado, lo que puede posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-13597", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13597", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-26T14:54:48.953212Z", "version": "2.0.3"}}]}, "published": "2025-11-25T23:15:47.377", "references": [{"source": "security@wordfence.com", "url": "https://github.com/d0n601/CVE-2025-13597"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ai-feeds/trunk/actualizador_git.php#L1"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402321/ai-feeds"}, {"source": "security@wordfence.com", "url": "https://ryankozak.com/posts/cve-2025-13597"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5007dd0-a62c-4ad8-8f8b-eb3f4387c370?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:17:32.201179+00:00", "value": {"mitigation_remediation": ["Upgrade the AI Feeds plugin to the latest release where the upload restriction has been corrected.", "If upgrading is not immediately possible, delete or deactivate the AI Feeds plugin to remove the vulnerable code from the site.", "Configure web security controls (e.g., a WAF or security plugin) to block unauthenticated file uploads and harden file\u2011write permissions for the plugin directory."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via File Upload"}, "threat_synthesis": {"affected_systems": "All installations of AI Feeds version 1.0.11 and earlier, distributed by soportecibeles, are affected. Any WordPress site that has not upgraded or disabled the plugin is vulnerable, regardless of additional configuration.", "description_and_impact": "The AI Feeds plugin for WordPress suffers from an unauthenticated file\u2011upload flaw exposed through the actualizador_git.php endpoint. Because the code omits a capability check, any visitor can cause the plugin to download arbitrary GitHub repositories and overwrite plugin files on the server. If an attacker replaces a plugin file with malicious code, remote execution is possible. The flaw is a classic example of CWE\u2011434, an unrestricted upload of a dangerous type.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% points to a low but non\u2011zero exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog, so no widespread exploitation is currently reported. Attackers can exploit the flaw over HTTP without authentication and overwrite plugin files, potentially delivering arbitrary code."}}}}, "created": "2025-11-27T09:45:33.653042+00:00", "updated": "2026-04-21T01:30:24.385477+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}