CVE-2025-13543
Published: 04 December 2025
Summary
CVE-2025-13543 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-13543 is an arbitrary file upload vulnerability in the PostGallery plugin for WordPress, affecting all versions up to and including 1.12.5. The issue stems from incorrect file type validation in the 'PostGalleryUploader' class functions, allowing attackers to bypass restrictions and upload malicious files to the server. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with subscriber-level permissions or higher can exploit this vulnerability remotely without user interaction. By uploading arbitrary files, such as web shells, they can achieve potential remote code execution on the affected WordPress site, leading to full server compromise including high confidentiality, integrity, and availability impacts.
Advisories reference the vulnerable source code in PostGalleryUploader.php at https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php and provide further details via Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201275
Vulnerability details
The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up to, and including, 1.12.5. This makes it possible for authenticated attackers, with subscriber-level and…
more
above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and deployment of web shells for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the vulnerability by patching the PostGallery plugin to fix the incorrect file type validation.
Information input validation enforces proper checking of file types and contents during uploads, preventing arbitrary file uploads that bypass plugin logic.
Malicious code protection scans uploaded files for dangerous types like web shells, detecting and blocking exploits even if validation fails.