CVE-2025-69312
Published: 22 January 2026
Summary
CVE-2025-69312 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Shell (T1100); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents unrestricted upload of dangerous files like web shells by enforcing input validation on file types and content at upload points in the plugin.
Restricts file uploads to only permitted types and parameters, blocking dangerous file types exploitable in the Xpro Elementor Addons plugin.
Scans uploads for malicious code such as web shells at system entry points, eradicating them before execution on the web server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing WordPress plugin directly enables web shell deployment (T1100) and exploitation of a public-facing application (T1190) for RCE.
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.
Deeper analysisAI
CVE-2025-69312 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Xpro Elementor Addons WordPress plugin (xpro-elementor-addons). This issue affects all versions from n/a through 1.4.19.1 and enables attackers to upload a web shell to the web server. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for severe impact across confidentiality, integrity, and availability.
The attack scenario requires network access with low complexity and no user interaction, but demands high privileges (PR:H), such as those held by an authenticated administrator. A successful exploit allows the upload of dangerous files like web shells directly to the web server, enabling remote code execution and potentially full server compromise given the changed scope (S:C) and high impact metrics.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/xpro-elementor-addons/vulnerability/wordpress-xpro-elementor-addons-plugin-1-4-19-1-arbitrary-file-upload-vulnerability?_s_id=cve. The CVE was published on 2026-01-22T17:16:26.840.
Details
- CWE(s)