PT-2025-50813 · WordPress · Infility Global

Kenneth Dunn · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-12968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infility Global versions prior to 2.14.24

Description The Infility Global plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation and missing capability checks. The upload file function within the infility import file class validates only the MIME type, which can be easily manipulated. Additionally, the import data function lacks proper capability checks. This allows authenticated attackers with subscriber-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update Infility Global to version 2.14.24 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-12968

Affected Products

Infility Global

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12968 · Security Note
• https://wordpress.org/plugins/infility-global · Note
• https://twitter.com/cracbot/status/2001246040138375519 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3421596%40infility-global&new=3421596%40infility-global&sfp_email=&sfph_mail= · Note
• https://twitter.com/CveFindCom/status/1999338353901056281 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=cve · Note