CVE-2025-12968
Arbitrary File Upload in Infility Global Plugin Enables RCE
Publication date: 2025-12-12
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| infility | global_plugin | 2.14.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Infility Global plugin for WordPress up to version 2.14.23. It allows authenticated users with subscriber level access or higher to upload arbitrary files to the server because the plugin only validates MIME types, which can be spoofed, and lacks proper capability checks. This can lead to remote code execution on the affected site.
How can this vulnerability impact me? :
An attacker with subscriber level access or above can upload arbitrary files to the server, potentially leading to remote code execution. This can compromise the website's security, allowing attackers to execute malicious code, steal data, or disrupt services.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps to mitigate this vulnerability include updating the Infility Global plugin for WordPress to a version later than 2.14.23 where the issue is fixed, restricting user permissions to prevent subscriber level users from uploading files, and implementing additional server-side file upload validation and capability checks to prevent arbitrary file uploads.