Arbitrary File Upload Vulnerability in RESTful Content Syndication Plugin for WordPress

CVE-2025-12171

What is CVE-2025-12171?

The RESTful Content Syndication plugin for WordPress has a security flaw that allows authenticated users with Author-level access and higher to upload arbitrary files due to a lack of adequate file type validation in the ingest_image() function. This vulnerability opens the door for potential remote code execution if the attacker can connect to a predefined third-party server. While it is less likely to be exploited by contributor-level users, it poses a significant risk when accessed by users with administrator privileges who can modify plugin settings.

References