Authenticated File Upload Vulnerability in WP Dropzone Plugin for WordPress

CVE-2025-12775

What is CVE-2025-12775?

The WP Dropzone plugin for WordPress contains a vulnerability that allows authenticated users to upload arbitrary files due to improper file type validation. The issue arises from the plugin's ajax_upload_handle function, which permits chunked uploads directly to the uploads directory without first validating the file type. This flaw, present in all versions up to and including 1.1.0, enables users with subscriber-level access or higher to potentially upload harmful files, leading to remote code execution and compromising the security of the affected WordPress site.

References