CVE-2025-12966
Published: 06 December 2025
Summary
CVE-2025-12966 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12966 is an arbitrary file upload vulnerability in the All-in-One Video Gallery plugin for WordPress, affecting versions 4.5.4 through 4.5.7. The flaw arises from missing file type validation in the resolve_import_directory() function, allowing attackers to upload files without proper restrictions. Published on 2025-12-06, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with Author-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables uploading arbitrary files to the server's filesystem, which may lead to remote code execution depending on the file type and server configuration.
Advisories point to mitigation via a patch in WordPress plugin trac changeset 3405593, which updates the admin/import-export.php file in the plugin trunk. Further details on the vulnerability and remediation are provided in the Wordfence threat intelligence report.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201544
Vulnerability details
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above,…
more
to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and facilitates remote code execution via web shell deployment (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation ensures timely patching of the specific arbitrary file upload vulnerability in the WordPress plugin versions 4.5.4 to 4.5.7.
Information input validation enforces file type checks missing in the resolve_import_directory() function, directly preventing arbitrary file uploads.
Least privilege restricts Author-level and higher access to the vulnerable upload functionality, reducing the attack surface for authenticated exploitation.