Arbitrary File Upload Vulnerability in WordPress Automatic Plugin by WordPress

CVE-2025-5395

What is CVE-2025-5395?

The WordPress Automatic Plugin is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation in the core.php file. This flaw affects all versions up to and including 3.115.0, allowing authenticated attackers with Author-level access or higher to upload problematic files on the server. Successfully exploiting this vulnerability could lead to remote code execution, posing significant risks to the integrity and security of affected WordPress sites.

References