CVE-2025-6086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6086", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-14T00:48:25.829Z", "datePublished": "2025-06-18T09:21:31.021Z", "dateUpdated": "2026-04-08T17:04:14.138Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:14.138Z"}, "affected": [{"vendor": "scottyla", "product": "CSV Me", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83bf3f3d-49f1-473a-a9ee-d78eb8981ad3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/csv-me/trunk/csv_me_index.php#L49"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "timeline": [{"time": "2025-06-17T20:42:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-18T13:40:31.608725Z", "id": "CVE-2025-6086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T13:40:45.108Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-18T13:40:31.608725Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T13:40:40.679Z"}}], "cna": {"title": "CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "scottyla", "product": "CSV Me", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-17T20:42:24.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83bf3f3d-49f1-473a-a9ee-d78eb8981ad3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/csv-me/trunk/csv_me_index.php#L49"}], "descriptions": [{"lang": "en", "value": "The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-06-18T09:21:31.021Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6086", "state": "PUBLISHED", "dateUpdated": "2025-06-18T13:40:45.108Z", "dateReserved": "2025-06-14T00:48:25.829Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-18T09:21:31.021Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CSV Me", "vendor": "scottyla", "versions": [{"lessThanOrEqual": "2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El complemento CSV Me para WordPress es vulnerable a la carga de archivos arbitrarios debido a una validaci\u00f3n insuficiente del tipo de archivo en la funci\u00f3n 'csv_me_options_page' en todas las versiones hasta la 2.0 incluida. Esto permite que atacantes autenticados, con acceso de administrador o superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-6086", "lastModified": "2026-06-17T10:01:07.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-18T13:40:31.608725Z", "version": "2.0.3"}}]}, "published": "2025-06-18T10:15:42.230", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/csv-me/trunk/csv_me_index.php#L49"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83bf3f3d-49f1-473a-a9ee-d78eb8981ad3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:10:03.820138+00:00", "value": {"mitigation_remediation": ["Upgrade CSV Me to version 2.1 or later, which removes the vulnerable upload endpoint.", "If an upgrade is not immediately possible, disable the CSV Me plugin or prevent access to the csv_me_options_page by applying a temporary role\u2011based restriction for all users below Administrator level.", "Implement server\u2011side file type validation or use a web application firewall rule to block execution of uploaded scripts in the uploads directory."], "summary": {"action": "Immediate patch", "impact": "Arbitrary file upload with potential remote code execution"}, "threat_synthesis": {"affected_systems": "All WordPress installations that use CSV Me version 2.0 or earlier are at risk. The plugin, provided by scottyla via the WordPress plugin repository, typically runs within a WordPress site where administrators have editing privileges. No specific WordPress core or server version constraints are listed, but the vulnerability exists whenever the vulnerable plugin version is active.", "description_and_impact": "The CSV Me WordPress plugin has been found to allow authenticated users with Administrator-level access to upload arbitrary files to the server. This flaw arises from insufficient file type validation in the csv_me_options_page function in all versions up to and including 2.0. An attacker who can upload files may select a malicious payload such as a PHP script, potentially leading to full remote code execution, data theft, or site defacement.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a medium\u2011to\u2011high severity, reflecting the need for privileged access and the possibility of remote code execution. The EPSS score of 1% suggests that while the overall probability of exploitation in the wild is low, it is not negligible. The vulnerability is not currently listed in CISA\u2019s KEV catalog, meaning there are no known large\u2011scale exploit campaigns at this time. The likely attack vector requires an administrator or higher role within the WordPress site to upload a file, after which the attacker can potentially trigger execution of the uploaded content on the server."}}}}, "created": "2026-04-21T20:15:44.578492+00:00", "updated": "2026-04-21T20:15:44.578505+00:00", "vendors": []}