CVE-2025-12181

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-05

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-05

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-12-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12181

EUVD

EUVD-2025-201376

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	wordpress	*
contentstudio	contentstudio	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

The vulnerability in the ContentStudio plugin for WordPress allows authenticated users with Author-level access or higher to upload arbitrary files to the server because the plugin does not properly validate file types in the cstu_update_post() function. This can potentially lead to remote code execution on the affected site.

Impact Analysis

This vulnerability can allow attackers with Author-level access to upload malicious files to your server, which may lead to remote code execution. This can compromise the security and integrity of your website and server, potentially resulting in data breaches, defacement, or further exploitation.

Mitigation Strategies

To mitigate this vulnerability, immediately update the ContentStudio WordPress plugin to version 1.4.0 or later, as versions up to and including 1.3.7 are vulnerable. Additionally, restrict Author-level access and above to trusted users only, and consider disabling or removing the plugin until a secure version is confirmed. Ensure your WordPress and PHP versions meet the plugin requirements (WordPress 5.8+ and PHP 7.4+). [1]

Hi! I’m here to help you understand CVE-2025-12181. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70