Arbitrary File Upload Vulnerability in Featured Image via URL Plugin for WordPress

CVE-2025-12153

What is CVE-2025-12153?

The Featured Image via URL plugin for WordPress contains a security flaw that allows authenticated attackers with Contributor-level access and higher to perform arbitrary file uploads. This vulnerability stems from inadequate file type validation, enabling attackers to upload malicious files to the server. Such uploads could lead to potential remote code execution, posing a significant risk to the integrity and security of the affected WordPress site.

References