PT-2025-47260 · WordPress · Wp Dropzone

Kenneth Dunn · Published 2025-11-18 · Updated 2025-11-23 · CVE-2025-12775

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Dropzone versions prior to 1.1.1

Description The WP Dropzone plugin for WordPress is susceptible to unauthorized file uploads. Authenticated attackers with subscriber-level access or higher can upload arbitrary files to the server through the ajax upload handle function. This is due to a flaw in the chunked upload functionality, which writes files to the uploads directory without proper file type validation. Successful exploitation may lead to remote code execution.

Recommendations Update WP Dropzone to version 1.1.1 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12775

Affected Products

Wp Dropzone

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12775 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.0/includes/class-plugin.php#L88 · Note
• https://twitter.com/cracbot/status/1992548746350215236 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/afd7aeb7-2c6f-4b23-b8b1-52fb010e5aac?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.0/includes/class-plugin.php#L127 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395966%40wp-dropzone&new=3395966%40wp-dropzone&sfp_email=&sfph_mail= · Note
• https://twitter.com/CveFindCom/status/1990883321337839635 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1991491718286360958 · Twitter Post
• https://twitter.com/CVEnew/status/1990703891479212269 · Twitter Post
• https://twitter.com/CveTodo/status/1990716742331465861 · Twitter Post