CVE-2025-12154
Published: 05 December 2025
Summary
CVE-2025-12154 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12154 affects the Auto Thumbnailer plugin for WordPress, specifically due to missing file type validation in the uploadThumb() function across all versions up to and including 1.0. This flaw enables arbitrary file uploads, as documented in the CVE published on 2025-12-05. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By uploading arbitrary files to the affected WordPress site's server, they may achieve remote code execution, granting high levels of confidentiality, integrity, and availability impact.
For mitigation details, refer to advisories from the plugin page at https://wordpress.org/plugins/auto-thumbnailer/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c98191-bf17-4e94-88cc-ad385b1fe97d?source=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201365
Vulnerability details
The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access…
more
and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in WordPress plugin enables exploitation of public-facing application (T1190) and facilitates web shell deployment for RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation of information inputs like file uploads to enforce file type restrictions, addressing the core missing validation in uploadThumb().
Ensures timely identification, reporting, and remediation of the specific flaw in the Auto Thumbnailer plugin, preventing exploitation via patching.
Enforces least privilege to restrict Contributor-level users from accessing upload functions if not essential, reducing the authenticated attack surface.