VULNERABILITY INTELLIGENCE

CVE-2025-4954

CVSS score8.8 HIGH
EPSS probability0.61%
CISA KEVNot currently listed
Published2025-06-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server

Weakness classification

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references