CVE-2025-9216

High

Published: 17 September 2025

Published

17 September 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0070 72.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9216 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-9216 is an arbitrary file upload vulnerability in the StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress. The issue stems from missing file type validation in the import() function located in addons/csv/ajax/import.php, affecting all versions up to and including 1.5.0. It has been assigned CWE-434 (Unrestricted Upload of File with Dangerous Type) and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By uploading arbitrary files to the affected site's server via the import functionality, attackers may achieve remote code execution, granting high confidentiality, integrity, and availability impacts.

Mitigation details are available in referenced advisories, including a Wordfence threat intelligence report and a WordPress plugin trac changeset (3360097) that patches the vulnerable import.php file. Security practitioners should update the StoreEngine plugin to a version beyond 1.5.0, as indicated by the patch commit, and review sites running affected versions. Additional technical analysis is provided in the CVE GitHub repository and related blog posts.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-29693

Vulnerability details

The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and including,…

1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Arbitrary file upload (CWE-434) in public-facing WordPress plugin directly enables exploitation of the web application for RCE; attackers can upload and execute a web shell.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1