CVE-2025-1028
Published: 05 February 2025
Summary
CVE-2025-1028 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to and including 8.6.4. This flaw, tracked as CVE-2025-1028 and assigned CWE-434, carries a CVSS 3.1 score of 8.1 and affects the plugin's handling of uploaded files on the server.
Unauthenticated attackers can exploit the issue remotely by submitting crafted files through the contact form. Successful exploitation may enable remote code execution on sites where the first file extension is processed preferentially, although the attack also requires winning a race condition on the target server.
A fix is available in version 8.6.5, as shown in the official WordPress plugin changeset and detailed in the Wordfence threat intelligence advisory.
The associated EPSS score rose from a low baseline to a peak of 0.0648 on 2026-03-16 before receding to the current value of 0.0255, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1976
Vulnerability details
The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to…
more
upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload without validation on public-facing WordPress plugin directly enables remote exploitation (T1190) and deployment of web shells for RCE/persistence (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation in the contact form upload feature by requiring checks on the validity of uploaded files to prevent arbitrary file acceptance.
Mitigates the vulnerability through identification, reporting, and correction of the specific flaw in Contact Manager versions up to 8.6.4 by applying the patch to version 8.6.5.
Prevents exploitation by restricting the types of information inputs accepted via the contact form, blocking arbitrary files including those enabling RCE in susceptible configurations.