CVE-2025-12968

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-129696.5Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditiCVE-2025-129708.8The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating lengCVE-2025-129714.3The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthoriCVE-2025-129725.3Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugiCVE-2025-129737.2The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due CVE-2025-129748.1The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked uplCVE-2025-129757.2The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a miCVE-2025-129766.4The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pluginCVE-2025-129779.1Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the abCVE-2025-129785.4Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exactCVE-2025-129795.3The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_expCVE-2025-12989.8Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.