CVE-2025-10041: 
WordPress vulnerability analysis and mitigation

The Flex QR Code Generator plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2025-10041) discovered in versions up to and including 1.2.5. The vulnerability exists due to missing file type validation in the save_qr_code_to_db() function, allowing unauthenticated attackers to upload arbitrary files to the affected site's server (NVD).

The vulnerability stems from improper file type validation in the save_qr_code_to_db() function, which can be found in the plugin's source code. The issue has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected WordPress site's server. This could potentially lead to remote code execution, giving attackers complete control over the affected website (NVD).

The vulnerability requires no authentication or special access privileges to exploit. An attacker only needs to be able to send HTTP requests to the affected WordPress site to potentially exploit this vulnerability (NVD).

Website administrators running the Flex QR Code Generator plugin should immediately update to a version newer than 1.2.5 when available. Until a patch is released, it is recommended to disable or remove the plugin to prevent potential exploitation (WordPress Plugin).