PT-2025-39947 · WordPress · Post By Email

Jonas Benjamin Friedli · Published 2025-09-30 · Updated 2025-10-05 · CVE-2025-9762

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Post By Email versions through 1.0.4b

Description The Post By Email plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the save attachments function. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. The save attachments function is the point of entry for this issue.

Recommendations Versions prior to 1.0.4b should be updated to a newer version that addresses this issue.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-9762

Affected Products

Post By Email

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-9762 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/885eb923-8e69-416b-8494-a42a9465cfe0?source=cve · Note
• https://t.me/CVEtracker/33716 · Telegram Post
• https://twitter.com/cracbot/status/1974791726670676474 · Twitter Post
• https://twitter.com/offseq/status/1972882131794706508 · Twitter Post
• https://plugins.trac.wordpress.org/browser/post-by-email/tags/1.0.4b/class-post-by-email.php#L702 · Note
• https://twitter.com/ZeroPathLabs/status/1973005894469173374 · Twitter Post
• https://twitter.com/0dayPublishing/status/1972868702933598389 · Twitter Post
• https://twitter.com/CVEnew/status/1972878682516508783 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1974377543399846250 · Twitter Post