Arbitrary file upload in Anthonyeden Restful Content Syndication
CVE-2025-12171
The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This requires the attacker have access to a defined third-party server as specified in the settings, so it is unlikely that this will be exploitable by contributor-level users, and more likely to be exploited by administrators who also have access to the plugin's settings.
Vulnerability class: Unrestricted File Upload
EPSS: 0.005 (40.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Anthonyeden Restful Content Syndication — versions 1.1.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-12171?
- CVE-2025-12171 is a high-severity vulnerability in Anthonyeden Restful Content Syndication, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2025-11-01.
- How severe is CVE-2025-12171?
- High severity. CVSS v3 base score is 8.8 out of 10.