PT-2025-45549 · WordPress · Smart Auto Upload Images

Dieu Link + 1 · Published 2025-11-08 · Updated 2025-11-13 · CVE-2025-12161

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Smart Auto Upload Images versions prior to 1.2.1

Description The Smart Auto Upload Images plugin for WordPress is affected by a flaw related to missing file type validation during the auto-image creation process. This allows authenticated attackers with Contributor-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution. The plugin’s auto-image creation functionality does not properly check the type of uploaded files. This allows attackers to bypass security measures and upload malicious files.

Recommendations Versions prior to 1.2.1 should be updated to address this issue.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12161

Affected Products

Smart Auto Upload Images

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12161 · Security Note
• https://twitter.com/VulmonFeeds/status/1987112840126230861 · Twitter Post
• https://twitter.com/CveTodo/status/1987016794565988458 · Twitter Post
• https://twitter.com/CVEnew/status/1987011683953349005 · Twitter Post
• https://twitter.com/CveFindCom/status/1987017523238154572 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/86dab8e6-b9fd-45ca-bdd1-8665f3bb75f2?source=cve · Note
• https://twitter.com/cracbot/status/1988924861901861000 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fsmart-auto-upload-images%2Ftags%2F1.2.0&old=3388129&new_path=%2Fsmart-auto-upload-images%2Ftags%2F1.2.1&new=3388129&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/36851 · Telegram Post