CVE-2025-12181
Published: 05 December 2025
Summary
CVE-2025-12181 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12181 is an arbitrary file upload vulnerability in the ContentStudio plugin for WordPress, stemming from missing file type validation in the cstu_update_post() function. It affects all versions up to and including 1.3.7 and has been mapped to CWE-434 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CVE-2025-67910 is likely a duplicate of this issue.
Authenticated attackers with Author-level access or higher can exploit the vulnerability over the network with low complexity and no user interaction required. By uploading arbitrary files to the affected site's server, they can potentially achieve remote code execution, granting high levels of confidentiality, integrity, and availability impact.
Advisories from Wordfence and the WordPress plugin repository detail mitigation steps, including a patch committed in changeset 3412182 at plugins.trac.wordpress.org. Security practitioners should urge site administrators to update the ContentStudio plugin beyond version 1.3.7 via wordpress.org/plugins/contentstudio/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201376
Vulnerability details
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and…
more
above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in WordPress plugin enables exploitation of public-facing application (T1190) and deployment of web shells for RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of the specific flaw in the ContentStudio plugin's cstu_update_post() function by applying patches to versions beyond 1.3.7.
Mandates validation of file inputs at upload points to enforce missing file type checks and block arbitrary file uploads.
Restricts user installation of unapproved plugins like ContentStudio, preventing deployment of vulnerable versions on WordPress sites.