cnvd - cnvd-2025-12631

CNVD-2025-12631

Vulnerability from cnvd - Published: 2025-06-16

Title

WordPress WP User Frontend Pro plugin代码问题漏洞

Description

WordPress WP User Frontend Pro plugin是一款WordPress前端用户中心插件，提供了强大的前端管理功能。 WordPress WP User Frontend Pro plugin存在代码问题漏洞，该漏洞源于upload_files函数缺少文件类型验证，攻击者可利用该漏洞上传任意文件。

Severity

高

Patch Name

WordPress WP User Frontend Pro plugin代码问题漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://wordpress.org/plugins/wp-user-frontend/

Reference

https://headwayapp.co/wp-user-frontend-changelog

Impacted products

Name
WordPress WP User Frontend Pro plugin <=4.1.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-3054",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-3054"
    }
  },
  "description": "WordPress WP User Frontend Pro plugin\u662f\u4e00\u6b3eWordPress\u524d\u7aef\u7528\u6237\u4e2d\u5fc3\u63d2\u4ef6\uff0c\u63d0\u4f9b\u4e86\u5f3a\u5927\u7684\u524d\u7aef\u7ba1\u7406\u529f\u80fd\u3002 \n\nWordPress WP User Frontend Pro plugin\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eupload_files\u51fd\u6570\u7f3a\u5c11\u6587\u4ef6\u7c7b\u578b\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://wordpress.org/plugins/wp-user-frontend/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-12631",
  "openTime": "2025-06-16",
  "patchDescription": "WordPress WP User Frontend Pro plugin\u662f\u4e00\u6b3eWordPress\u524d\u7aef\u7528\u6237\u4e2d\u5fc3\u63d2\u4ef6\uff0c\u63d0\u4f9b\u4e86\u5f3a\u5927\u7684\u524d\u7aef\u7ba1\u7406\u529f\u80fd\u3002 \r\n\r\nWordPress WP User Frontend Pro plugin\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eupload_files\u51fd\u6570\u7f3a\u5c11\u6587\u4ef6\u7c7b\u578b\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WordPress WP User Frontend Pro plugin\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WordPress WP User Frontend Pro plugin \u003c=4.1.3"
  },
  "referenceLink": "https://headwayapp.co/wp-user-frontend-changelog",
  "serverity": "\u9ad8",
  "submitTime": "2025-06-11",
  "title": "WordPress WP User Frontend Pro plugin\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2025-3054 (GCVE-0-2025-3054)

Vulnerability from cvelistv5 – Published: 2025-06-05 05:23 – Updated: 2025-06-05 14:08

Summary

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

Wordfence

References

URL

Tags

	https://www.wordfence.com/threat-intel/vulnerabil…
	https://headwayapp.co/wp-user-frontend-changelog

Impacted products

	Vendor	Product	Version
	wedevs	WP User Frontend Pro	Affected: * , ≤ 4.1.3 (semver)

Credits

Friderika Baranyai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3054",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-05T13:18:35.182475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-05T14:08:06.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP User Frontend Pro",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "4.1.3",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Friderika Baranyai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible. Please note that this requires the \u0027Private Message\u0027 module to be enabled and the Business version of the PRO software to be in use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-05T05:23:00.228Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve"
        },
        {
          "url": "https://headwayapp.co/wp-user-frontend-changelog"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-06-04T16:33:46.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "WP User Frontend Pro \u003c= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-3054",
    "datePublished": "2025-06-05T05:23:00.228Z",
    "dateReserved": "2025-03-31T19:17:08.251Z",
    "dateUpdated": "2025-06-05T14:08:06.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-12631

CVE-2025-3054 (GCVE-0-2025-3054)

Tags

Sightings

Nomenclature