CVE-2025-2006
Published: 29 March 2025
Summary
CVE-2025-2006 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to and including 1.1.19. This issue, tracked as CVE-2025-2006 with a CVSS score of 8.8 and categorized under CWE-434, affects the plugin's handling of image uploads within BBPress forums on WordPress sites.
Authenticated attackers with Subscriber-level access or higher can exploit the flaw to upload arbitrary files to the server, which may enable remote code execution. The vulnerability may also be reachable by unauthenticated attackers if the site's "Allow guest users without accounts to create topics and replies" setting is enabled.
The EPSS score for this CVE rose from a low starting value of 0.0054 to a peak of 0.0126, indicating that exploitation interest emerged after disclosure. Reference materials from Wordfence and the plugin's Trac repository point to the affected code in bbp-image-upload.php and the corresponding changeset addressing the upload validation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8674
Vulnerability details
The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated…
more
attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This may be exploitable by unauthenticated attackers when the "Allow guest users without accounts to create topics and replies" setting is enabled.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vuln in public-facing WordPress plugin directly enables T1190 (exploiting public-facing app for initial access) and T1505.003 (uploading/executing web shell for RCE).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the arbitrary file upload flaw in the Inline Image Upload for BBPress plugin by requiring timely patching of affected versions up to 1.1.19.
Enforces file extension and content validation at upload points, directly countering the missing validation in the plugin's bbp-image-upload.php functionality.
Restricts uploads to only authorized image file types in the BBPress image upload feature, blocking arbitrary file submissions by authenticated or guest users.