PT-2025-44718 · WordPress · Wordpress Restful Content Syndication

Kenneth Dunn · Published 2025-11-01 · Updated 2025-11-01 · CVE-2025-12171

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress RESTful Content Syndication plugin versions 1.1.0 through 1.5.0

Description The RESTful Content Syndication plugin for WordPress is affected by a flaw that allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This is due to missing file type validation in the ingest image() function. Successful exploitation may lead to remote code execution. The attacker requires access to a defined third-party server as specified in the plugin's settings.

Recommendations Update the RESTful Content Syndication plugin to a version later than 1.5.0.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12171

Affected Products

Wordpress Restful Content Syndication

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12171 · Security Note
• https://twitter.com/CveTodo/status/1984524350758773224 · Twitter Post
• https://t.me/cveNotify/141247 · Telegram Post
• https://twitter.com/CVEnew/status/1984514499890622545 · Twitter Post
• https://twitter.com/CveFindCom/status/1984540980423344419 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984531472896655555 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384901%40restful-syndication&new=3384901%40restful-syndication&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/36374 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/99db7ac5-b7ac-4a4f-bd05-e563a3dfb839?source=cve · Note