CVE-2025-5831
Published: 25 July 2025
Summary
CVE-2025-5831 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themeum Droip. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Droip plugin for WordPress is affected by an arbitrary file upload vulnerability (CWE-434) present in all versions up to but not including 2.5.2. The flaw stems from missing file type validation inside the make_google_font_offline() function, allowing an attacker to place arbitrary files on the server.
Authenticated users with Subscriber-level access or higher can exploit the issue over the network without user interaction. Successful exploitation can result in remote code execution, as reflected in the CVSS 3.1 score of 8.8.
The referenced Wordfence advisory and the vendor site at droip.com indicate that the issue is resolved by updating to version 2.5.2 or later. No other specific configuration changes or workarounds are documented in the provided references.
EPSS remains low at 0.0135 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22576
Vulnerability details
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and…
more
above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in WordPress plugin directly enables web shell deployment (T1505.003) for RCE and exploitation of public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation in the make_google_font_offline() function by requiring validation of uploaded files to prevent arbitrary file acceptance.
Mandates timely flaw remediation, such as updating the Droip plugin to version 2.5.2 or later, to eliminate the arbitrary file upload vulnerability.
Provides malicious code protection through scanning uploaded files, mitigating potential remote code execution from dangerous uploads even if validation fails.