PT-2025-46282 · WordPress · Theme Editor

Kenneth Dunn · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12637

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elastic Theme Editor plugin for WordPress versions up to and including 0.0.3

Description The Elastic Theme Editor plugin for WordPress is susceptible to arbitrary file uploads. This is due to a dynamic code generation feature within the process theme function. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update the Elastic Theme Editor plugin to a version beyond 0.0.3.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-12637

Affected Products

Theme Editor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12637 · Security Note
• https://twitter.com/CveTodo/status/1988110756664004947 · Twitter Post
• https://twitter.com/CVEnew/status/1988095301157003748 · Twitter Post
• https://plugins.trac.wordpress.org/browser/elastic-theme-editor/trunk/editor/class-elastic-editor.php · Note
• https://t.me/CVEtracker/36985 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e158a13d-5452-492a-875e-53791e1ff840?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1988257708294766704 · Twitter Post