Cyber Resilience

CVE-2025-9762

CriticalRCE

Published: 30 September 2025

Published
30 September 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0044 63.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9762 is a critical-severity OS Command Injection (CWE-78) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-9762 is an arbitrary file upload vulnerability in the Post By Email plugin for WordPress, affecting all versions up to and including 1.0.4b. The issue stems from missing file type validation in the save_attachments function, allowing attackers to upload arbitrary files to the affected site's server. Published on 2025-09-30, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-78.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction. By uploading malicious files, they may achieve remote code execution on the server, leading to high confidentiality, integrity, and availability impacts.

Mitigation details are available in advisories including Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/885eb923-8e69-416b-8494-a42a9465cfe0?source=cve and the plugin source code at https://plugins.trac.wordpress.org/browser/post-by-email/tags/1.0.4b/class-post-by-email.php#L702.

EU & UK References

Vulnerability details

The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload…

more

arbitrary files on the affected site's server which may make remote code execution possible.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary unauthenticated file upload in public-facing WordPress plugin directly enables T1190 exploitation and T1505.003 web shell deployment for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-66644Shared CWE-78
CVE-2021-4473Shared CWE-78
CVE-2026-4631Shared CWE-78
CVE-2026-42062Shared CWE-78
CVE-2025-41709Shared CWE-78
CVE-2025-56819Shared CWE-78
CVE-2026-34176Shared CWE-78
CVE-2020-37125Shared CWE-78
CVE-2026-34387Shared CWE-78
CVE-2026-32968Shared CWE-78

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses the missing file type validation in the save_attachments function by enforcing validation of information inputs such as uploaded files.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of flaws like the arbitrary file upload vulnerability in the Post By Email plugin.

SI-3 Malicious Code Protection partial match
preventdetect

Mitigates potential remote code execution from uploaded arbitrary files by deploying malicious code protection mechanisms on the server.

References