Unrestricted File Upload Vulnerability in Zippy by Gesundheit Bewegt GmbH
CVE-2025-52758

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
Zippy
Vendor
CVE Published:
22 October 2025

What is CVE-2025-52758?

The Zippy plugin by Gesundheit Bewegt GmbH contains a vulnerability that allows unauthorized users to upload files of dangerous types. This can lead to the execution of malicious code on the server, potentially compromising the entire website. The issue is present in Zippy versions up to and including 1.7.0. Ensuring secure file upload policies and keeping plugins updated are critical to mitigating this risk.

Affected Version(s)

Zippy <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/zipp...
vdb-entry

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

63n0 (Patchstack Alliance)
JSON
.