Unrestricted File Upload Vulnerability in SUMO Affiliates Pro by FantasticPlugins
CVE-2025-32291

10CRITICAL

Key Information:

Vendor

WordPress
Status
Sumo Affiliates Pro
Vendor
CVE Published:
9 June 2025

What is CVE-2025-32291?

The SUMO Affiliates Pro plugin by FantasticPlugins is vulnerable to an unrestricted file upload issue, allowing attackers to upload files of dangerous types. This vulnerability can be exploited to carry out malicious activities by using modified files, potentially leading to unauthorized access or server compromise. Affected versions range from n/a through 10.7.0, necessitating immediate updates to secure installations.

Affected Version(s)

SUMO Affiliates Pro <= 10.7.0

References

https://patchstack.com/database/wordpress/plugin/affs/vul...
vdb-entry

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anhchangmutrang (Patchstack Alliance)
JSON
.