Arbitrary File Upload Vulnerability in Flex QR Code Generator Plugin for WordPress

CVE-2025-10041

What is CVE-2025-10041?

The Flex QR Code Generator plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to insufficient file type validation in the save_qr_code_to_db() function. This flaw allows unauthenticated attackers to upload potentially malicious files onto the server where the plugin is installed. As a result, attackers may exploit this vulnerability to execute arbitrary code remotely, compromising the security and integrity of the affected site. It is crucial for users to upgrade to the latest available version to mitigate this risk.

References