VULNERABILITY INTELLIGENCE
CVE-2025-12057
CVSS score9.8 CRITICAL
EPSS probability0.61%
CISA KEVNot currently listed
Published2025-11-19
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-434