Arbitrary File Upload Vulnerability in Pie Forms for WP Plugin by WordPress

CVE-2025-12528

What is CVE-2025-12528?

The Pie Forms for WP plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability in all versions up to and including 1.6. This issue arises from inadequate validation of uploaded file types, particularly within the format_classic function. The validate_classic method does check file extensions and sets corresponding error messages, but it fails to halt the file upload process. Consequently, unauthenticated attackers can potentially upload files with dangerous extensions including PHP, which may facilitate remote code execution. Exploitation requires knowledge of the directory structure where the files are stored, which can be inferred due to predictable hash generation. Although the file name is secured through a hash method, this vulnerability still poses a significant security threat.

References