PT-2025-14471 · WordPress · Front End Users

Kishan Vyas · Published 2025-04-02 · Updated 2025-08-12 · CVE-2025-2005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Front End Users plugin for WordPress versions up to, and including, 3.2.32

Description The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions up to, and including, 3.2.32, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the file uploads field in the registration form until a patch is available. Restrict access to the registration form to minimize the risk of exploitation. Avoid using the file uploads feature in the affected plugin until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-2005

Affected Products

Front End Users

References · 22

• 🔥 https://github.com/Nxploited/CVE-2025-2005 · Exploit
• 🔥 https://github.com/mrmtwoj/CVE-2025-2005 · Exploit
• https://osv.dev/vulnerability/CVE-2025-2005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2005 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303083%40front-end-only-users&new=3303083%40front-end-only-users&sfp_email=&sfph_mail= · Note
• https://wordpress.org/support/plugin/front-end-only-users · Note
• https://t.me/proxy_bar/2579 · Telegram Post
• https://twitter.com/akaclandestine/status/1907728885195878758 · Twitter Post
• https://t.me/cvetracker/20563 · Telegram Post
• https://t.me/ckearsenal/626 · Telegram Post
• https://t.me/secu_001/563 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/102223a1-07f5-485b-a6af-49cf316d9797?source=cve · Note
• https://twitter.com/vulns_space/status/1907383539588370432 · Twitter Post
• https://t.me/latest_high_impact_cve/2071 · Telegram Post
• https://twitter.com/CVEnew/status/1907551264831058429 · Twitter Post