PT-2025-32633 · WordPress · Anwp Football Leagues

Published 2025-08-12 · Updated 2025-08-12 · CVE-2025-8767

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: AnWP Football Leagues plugin for WordPress versions up to and including 0.16.17

Description: The AnWP Football Leagues plugin for WordPress is susceptible to CSV injection through the download csv players and download csv games functions. Authenticated attackers with Administrator-level access or higher can embed untrusted input into exported CSV files. This can lead to code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Recommendations: Update the AnWP Football Leagues plugin to a version later than 0.16.17.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-8767

Affected Products

Anwp Football Leagues

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-8767 · Security Note
• http://plugins.trac.wordpress.org/changeset/3342787/football-leagues-by-anwppro/trunk/includes/class-anwpfl-data-port.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/04676263-cdad-40cd-bb54-61beb727e09d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/football-leagues-by-anwppro/trunk/includes/class-anwpfl-data-port.php#L58 · Note
• https://t.me/CVEtracker/29760 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1955178467080765610 · Twitter Post
• https://plugins.trac.wordpress.org/browser/football-leagues-by-anwppro/trunk/includes/class-anwpfl-data-port.php#L265 · Note
• https://plugins.trac.wordpress.org/browser/football-leagues-by-anwppro/trunk/includes/class-anwpfl-data-port.php#L93 · Note
• https://t.me/cveNotify/131780 · Telegram Post
• https://twitter.com/CVEnew/status/1955162411163586652 · Twitter Post