Arbitrary File Upload Vulnerability in Elastic Theme Editor for WordPress

CVE-2025-12637

What is CVE-2025-12637?

The Elastic Theme Editor plugin for WordPress contains a significant security flaw that enables authenticated users with Subscriber-level access and higher to upload arbitrary files. This vulnerability stems from a dynamic code generation in the process_theme function, resulting in a potential avenue for remote code execution on the server hosting the affected site. The flaw impacts all versions of the plugin up to and including 0.0.3, underscoring the urgent need for users to take action to secure their installations.

References