PT-2025-42278 · WordPress · Flex Qr Code Generator

Johska · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10041

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flex QR Code Generator versions through 1.2.5

Description The Flex QR Code Generator plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the save qr code to db() function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update Flex QR Code Generator to a version later than 1.2.5.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-10041

Affected Products

Flex Qr Code Generator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10041 · Security Note
• https://twitter.com/Nxploited/status/1978369742059499655 · Twitter Post
• https://t.me/cveNotify/138719 · Telegram Post
• https://twitter.com/CVEnew/status/1978562034460393584 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1978393563952984125 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/40000879-a5ef-48f2-97e4-77d527259af0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/flex-qr-code-generator/tags/1.2.5/qr-code-generator.php#L208 · Note
• https://wordpress.org/plugins/flex-qr-code-generator · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379026%40flex-qr-code-generator&new=3379026%40flex-qr-code-generator&sfp_email=&sfph_mail= · Note