CVE-2025-12171

The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This requires the attacker have access to a defined third-party server as specified in the settings, so it is unlikely that this will be exploitable by contributor-level users, and more likely to be exploited by administrators who also have access to the plugin's settings.

• CWE-434

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384901%40restful-syndication&new=3384901%40restful-syndication&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/99db7ac5-b7ac-4a4f-bd05-e563a3dfb839?source=cve

Published

Nov 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12166The Appointment Booking Calendar — Simply Schedule Appointme…7.5
• CVE-2025-12167The Contact Form 7 AWeber Extension plugin for WordPress is …4.3
• CVE-2025-12168The Phrase TMS Integration for WordPress plugin for WordPres…4.3
• CVE-2025-12169The ELEX WordPress HelpDesk & Customer Ticketing System plug…4.3
• CVE-2025-1217In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f…3.1
• CVE-2025-12170The Checkbox plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2025-12172The Mailchimp List Subscribe Form plugin for WordPress is vu…4.3
• CVE-2025-12173The WP Admin Microblog plugin for WordPress is vulnerable to…4.3
• CVE-2025-12174The Directorist: AI-Powered Business Directory Plugin with C…6.5
• CVE-2025-12175The The Events Calendar plugin for WordPress is vulnerable t…4.3
• CVE-2025-12176Undocumented administrative accounts were getting created to…9.8
• CVE-2025-12177The Download Manager plugin for WordPress is vulnerable to u…5.3