CVE-2025-12057

Description

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE

PUBLISHED Reserved 2025-10-22 | Published 2025-11-19 | Updated 2025-11-19 | Assigner WPScan

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Credits

@zdenys finder

WPScan coordinator

References

wpscan.com/...rability/110db433-01ec-47ea-b74f-c3faa1757a3c/ exploit vdb-entry technical-description

cve.org (CVE-2025-12057)

nvd.nist.gov (CVE-2025-12057)

Download JSON