Cyber Resilience

CVE-2025-7437

Critical

Published: 24 July 2025

Published
24 July 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0133 80.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7437 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function. This affects all versions up to and including 5.8012 and is tracked as CWE-434. The flaw carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

Unauthenticated attackers can upload arbitrary files to the affected site’s server, which may enable remote code execution and full compromise of the WordPress installation. The vulnerability can be reached directly over the network by sending crafted requests to the vulnerable function.

Public references include a WordPress plugin changeset that addresses the issue along with analysis from Wordfence. The associated EPSS score remains low and flat at 0.0133 with no material increase after disclosure.

EU & UK References

Vulnerability details

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary…

more

files on the affected site's server which may make remote code execution possible.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary unauthenticated file upload in public-facing WordPress plugin directly enables exploitation of public-facing application (T1190) and deployment of web shell for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses the missing file type validation in ebook_store_save_form by requiring comprehensive validation of uploaded files to block arbitrary dangerous files.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation and patching of the specific flaw in the Ebook Store plugin up to version 5.8012, eliminating the arbitrary file upload vulnerability.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on file uploads such as type, size, and content to prevent unauthenticated attackers from uploading arbitrary files leading to RCE.

References