CVE-2025-67910
Published: 08 January 2026
Summary
CVE-2025-67910 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates file uploads to restrict dangerous types like web shells, directly preventing exploitation of the unrestricted upload vulnerability.
Remediates the specific flaw in Contentstudio versions through 1.3.7 by applying patches or updates to eliminate the upload vulnerability.
Enforces least privilege to limit high-privilege administrator access to file upload functions, reducing the attack surface for exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload (CWE-434) in public-facing WordPress plugin directly enables web shell deployment (T1505.003) after initial exploitation of the exposed application (T1190).
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.
Deeper analysisAI
CVE-2025-67910 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Contentstudio WordPress plugin. This issue affects Contentstudio versions from an unspecified initial release through 1.3.7 and enables attackers to upload a web shell to the web server. The vulnerability received a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
The vulnerability can be exploited over the network with low complexity and no user interaction, but requires high privileges such as those held by an authenticated administrator. Successful exploitation changes the scope of impact, granting attackers high levels of control over confidentiality, integrity, and availability, primarily through the deployment of a web shell that facilitates remote code execution on the server.
Patchstack has published an advisory detailing the arbitrary file upload vulnerability in Contentstudio plugin version 1.3.7, available at https://patchstack.com/database/Wordpress/Plugin/contentstudio/vulnerability/wordpress-contentstudio-plugin-1-3-7-arbitrary-file-upload-vulnerability?_s_id=cve.
Details
- CWE(s)