PT-2025-30632 · WordPress · Ebook Store

Michael Mazzolini · Published 2025-07-24 · Updated 2025-08-08 · CVE-2025-7437

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ebook Store plugin for WordPress versions prior to 5.8012

Description The Ebook Store plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the ebook store save form function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update the Ebook Store plugin to a version later than 5.8012.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-7437

Affected Products

Ebook Store

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7437 · Security Note
• https://plugins.trac.wordpress.org/changeset/3328355 · Note
• https://plugins.trac.wordpress.org/browser/ebook-store/trunk/functions.php#L2442 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0dc5c05d-51b7-4aee-bb4e-366ded45c4d8?source=cve · Note
• https://twitter.com/jmdevlabs/status/1953815397318177082 · Twitter Post
• https://twitter.com/cracbot/status/1950149343128014998 · Twitter Post
• https://twitter.com/CVEnew/status/1948245085616837073 · Twitter Post
• https://twitter.com/CveFindCom/status/1948241850306863610 · Twitter Post