Arbitrary File Upload Vulnerability in AIO Forms Plugin for WordPress by WordPress
CVE-2025-11889

7.2HIGH

Key Information:

Vendor

WordPress
Status
Aio Forms – Craft Complex Forms Easily
Vendor
CVE Published:
24 October 2025

What is CVE-2025-11889?

The AIO Forms plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation in its import feature. This vulnerability affects all versions up to and including 1.3.15. Authenticated attackers with Administrator-level access or higher can exploit this flaw to upload arbitrary files to the server of the affected site. This situation poses a significant risk, including the potential for remote code execution, highlighting the necessity for prompt remediation and monitoring of affected installations.

Affected Version(s)

AIO Forms – Craft Complex Forms Easily * <= 1.3.15

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/all-in-one-forms/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tmrswrr
JSON
.