CVE-2025-12057

Published Nov 19, 2025·Updated Jun 17, 2026

NVD Description

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE

Public Exploits & PoCs1 found

PoC: CVE-2025-12057-WordPress-Exploit-PoC

PoC for CVE-2025-12057 - Unauthenticated Arbitrary File Upload in WavePlayer WordPress plugin leading to RCE

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free