CVE-2025-2005

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 2, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-200506.7Uncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escCVE-2025-200516.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching andCVE-2025-200527.3Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via locaCVE-2025-200537.2Improper buffer restrictions for some Intel(R) Xeon(R) Processor firmware with SGX enabled may allow a privileged user to potentially enableCVE-2025-200546.5Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaCVE-2025-200559.8OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can aCVE-2025-200564.4Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of prCVE-2025-200573.5Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to pCVE-2025-200587.5When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilizCVE-2025-200599.1Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java PoCVE-2025-20068.8The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation inCVE-2025-200607.5An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android devic