CVE-2025-5395

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5395", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-30T16:08:21.847Z", "datePublished": "2025-06-11T06:39:46.773Z", "dateUpdated": "2026-04-08T16:54:27.657Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:27.657Z"}, "affected": [{"vendor": "ValvePress", "product": "WordPress Automatic Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.115.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=cve"}, {"url": "https://codecanyon.net/item/wordpress-automatic-plugin/1904470#item-description__changelog"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "timeline": [{"time": "2025-06-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T13:21:58.966891Z", "id": "CVE-2025-5395", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:22:05.731Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-11T13:21:58.966891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:22:01.373Z"}}], "cna": {"title": "WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ValvePress", "product": "WordPress Automatic Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.115.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=cve"}, {"url": "https://codecanyon.net/item/wordpress-automatic-plugin/1904470#item-description__changelog"}], "descriptions": [{"lang": "en", "value": "The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:27.657Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5395", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:27.657Z", "dateReserved": "2025-05-30T16:08:21.847Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-11T06:39:46.773Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WordPress Automatic Plugin", "vendor": "ValvePress", "versions": [{"lessThanOrEqual": "3.115.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El complemento WordPress Automatic Plugin de WordPress es vulnerable a la carga de archivos arbitrarios debido a una validaci\u00f3n insuficiente del tipo de archivo en el archivo 'core.php' en todas las versiones hasta la 3.115.0 incluida. Esto permite que atacantes autenticados, con acceso de autor o superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-5395", "lastModified": "2026-06-17T09:47:50.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5395", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-11T13:21:58.966891Z", "version": "2.0.3"}}]}, "published": "2025-06-11T07:15:24.800", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/wordpress-automatic-plugin/1904470#item-description__changelog"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:20:54.477616+00:00", "value": {"mitigation_remediation": ["Upgrade the WordPress Automatic Plugin to version 3.116 or later, which removes the file type validation flaw.", "Revoke or restrict Author\u2011level users that do not require the ability to upload content, ensuring only trusted administrators can upload files.", "Configure the web server or use a security plugin to enforce strict file type checks (e.g., allow only image MIME types) and block PHP or executable file uploads to the plugin\u2019s upload directories."], "summary": {"action": "Patch Immediately", "impact": "Arbitrary File Upload with potential Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects ValvePress WordPress Automatic Plugin versions up to and including 3.115.0. It applies to any WordPress site that has this plugin installed and running the listed versions.", "description_and_impact": "The WordPress Automatic Plugin is vulnerable to arbitrary file uploads due to insufficient file type validation in the core.php file. Authenticated attackers of Author level or higher can upload any file, which may result in remote code execution. This weakness is identified as CWE-434, highlighting a lack of proper file type verification.", "risk_and_exploitability": "With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score of 1% indicates a low but non\u2011zero probability that it will be exploited before a patch is applied. The acceptance of the KEV status confirms it is not a widely documented exploitation scenario yet. The attack requires valid Author\u2011level credentials; once authenticated, the attacker can upload malicious files and potentially execute code on the server."}}}}, "created": "2025-06-23T09:16:30.086253+00:00", "updated": "2026-04-21T20:30:27.399077+00:00", "vendors": ["valvepress", "valvepress$PRODUCT$wordpress_automatic_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}