CVE-2025-11087
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: Wordfence

Description
The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-21
Last Modified
2025-11-21
Generated
2026-06-16
AI Q&A
2025-11-21
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11087
EUVD
EUVD-2025-198511
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wordpress zegen_core *
wordpress wordpress *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the Zegen Core plugin for WordPress (up to version 2.0.1) is a Cross-Site Request Forgery (CSRF) that allows arbitrary file uploads. This happens because the plugin lacks nonce validation and file type validation in a specific PHP file, enabling unauthenticated attackers to upload files to the server by tricking a site administrator into performing an action like clicking a malicious link.

Impact Analysis

This vulnerability can allow attackers to upload arbitrary files to your server, potentially leading to remote code execution. This means attackers could execute malicious code on your website, compromising its security, integrity, and availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart