Arbitrary File Upload Vulnerability in ContentStudio Plugin for WordPress

CVE-2025-12181

What is CVE-2025-12181?

The ContentStudio plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation within the cstu_update_post() function. This flaw affects all versions of the plugin up to and including 1.3.7 and can be exploited by authenticated users with Author-level access or higher. If successfully executed, this vulnerability may allow attackers to upload malicious files to the server, creating potential paths for remote code execution and significant security risks for the affected website.

References