Arbitrary File Upload Vulnerability in Smart Auto Upload Images Plugin for WordPress
CVE-2025-12161
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 November 2025
What is CVE-2025-12161?
The Smart Auto Upload Images plugin for WordPress allows authenticated users with Contributor-level access and above to upload arbitrary files due to inadequate validation of file types in its auto-image creation functionality. This vulnerability affects all versions up to and including 1.2.0, posing a potential risk of remote code execution on the affected server. Website administrators are urged to update to the latest version to mitigate this security risk.
Affected Version(s)
Smart Auto Upload Images – Import External Images * <= 1.2.0