BaseFortify

Publication date: 2025-11-04

Last updated on: 2026-04-08

Assigner: Wordfence

Description

Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-04

Last Modified

2026-04-08

Generated

2026-07-07

AI Q&A

2025-11-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-10896

EUVD

EUVD-2025-37604

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	wordpress	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects multiple WordPress plugins using the Jewel Theme Recommended Plugins Library. It allows authenticated users with subscriber-level access or higher to upload arbitrary plugin packages by exploiting missing capability checks in the '*_recommended_upgrade_plugin' function. This unrestricted upload of files with dangerous types can lead to remote code execution on the affected site.

Impact Analysis

An attacker with subscriber-level access or above can upload malicious plugin packages to the server, potentially leading to remote code execution. This can compromise the entire website, allowing the attacker to execute arbitrary code, steal data, deface the site, or use the server for further attacks.

Hi! I’m here to help you understand CVE-2025-10896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70