Cyber Resilience

CVE-2025-5831

High

Published: 25 July 2025

Published
25 July 2025
Modified
08 April 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0135 80.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-5831 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themeum Droip. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The Droip plugin for WordPress is affected by an arbitrary file upload vulnerability (CWE-434) present in all versions up to but not including 2.5.2. The flaw stems from missing file type validation inside the make_google_font_offline() function, allowing an attacker to place arbitrary files on the server.

Authenticated users with Subscriber-level access or higher can exploit the issue over the network without user interaction. Successful exploitation can result in remote code execution, as reflected in the CVSS 3.1 score of 8.8.

The referenced Wordfence advisory and the vendor site at droip.com indicate that the issue is resolved by updating to version 2.5.2 or later. No other specific configuration changes or workarounds are documented in the provided references.

EPSS remains low at 0.0135 with no material increase since disclosure.

EU & UK References

Vulnerability details

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and…

more

above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Arbitrary file upload in WordPress plugin directly enables web shell deployment (T1505.003) for RCE and exploitation of public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

themeum
droip
≤ 2.2.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the missing file type validation in the make_google_font_offline() function by requiring validation of uploaded files to prevent arbitrary file acceptance.

prevent

Mandates timely flaw remediation, such as updating the Droip plugin to version 2.5.2 or later, to eliminate the arbitrary file upload vulnerability.

preventdetect

Provides malicious code protection through scanning uploaded files, mitigating potential remote code execution from dangerous uploads even if validation fails.

References