Arbitrary File Upload Vulnerability in WP User Frontend Pro Plugin by WordPress

CVE-2025-3054

What is CVE-2025-3054?

The WP User Frontend Pro plugin for WordPress contains a vulnerability due to inadequate file type validation in its upload_files() function. This flaw affects all versions up to and including 4.1.3, allowing authenticated users with Subscriber-level access or higher to upload arbitrary files onto the server. The exploitation of this vulnerability requires the 'Private Message' module to be enabled and the Business version of the PRO software to be utilized, potentially leading to unauthorized remote code execution.

References