Arbitrary File Upload Vulnerability in Post By Email Plugin for WordPress
CVE-2025-9762
9.8CRITICAL
What is CVE-2025-9762?
The Post By Email plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation in the save_attachments function. This vulnerability affects all versions of the plugin up to and including version 1.0.4b. As a result, unauthenticated attackers have the potential to upload unauthorized files to the server hosting the affected WordPress site, possibly leading to remote code execution. Website administrators should promptly update to the latest version of the plugin and review their security configurations to mitigate the risks.
Affected Version(s)
Post By Email * <= 1.0.4b