CVE-2025-12968: 
WordPress vulnerability analysis and mitigation

CVE-2025-12968 is an arbitrary file upload vulnerability in the Infility Global plugin for WordPress, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). It affects all versions of the plugin up to and including 2.14.42, and allows authenticated attackers with subscriber-level access or higher to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability was published on December 12, 2025, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The vulnerability stems from two distinct weaknesses in the plugin's file import functionality. First, the upload_file function within the infility_import_file class only validates the MIME type of uploaded files, which can be trivially spoofed by an attacker manipulating the Content-Type header. Second, the import_data function lacks proper capability checks, meaning any authenticated user — including those with subscriber-level roles — can invoke it without restriction. Together, these flaws (CWE-434) allow low-privileged users to upload files of any type, including PHP web shells, to the server (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated attacker with minimal privileges (subscriber level or above) to upload arbitrary files — including PHP web shells — to the WordPress server, which can lead to full remote code execution. This compromises the confidentiality, integrity, and availability of the affected site, potentially granting the attacker persistent access to the server, the ability to exfiltrate sensitive data, modify site content, or pivot to other systems on the same network (Wordfence, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability requires authentication at the subscriber level, which slightly raises the bar for exploitation but remains a low barrier on sites with open registration. The EPSS score is approximately 0.0026 (0.26%), indicating a currently low probability of exploitation in the near term. The vulnerability has been detected by Qualys scanners and is referenced in a CISA vulnerability bulletin, but is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (CISA Bulletin).

1. Reconnaissance: Identify WordPress sites running the Infility Global plugin (versions ≤ 2.14.42) using tools like WPScan, Shodan, or by inspecting plugin directories at /wp-content/plugins/infility-global/.
2. Obtain low-privilege credentials: Register or obtain a subscriber-level account on the target WordPress site (many sites allow open registration).
3. Authenticate: Log in to the WordPress site and obtain a valid authentication cookie or nonce.
4. Craft malicious upload request: Prepare a PHP web shell file (e.g., shell.php) and set its Content-Type header to a permitted MIME type such as text/csv or application/octet-stream to bypass the MIME-only validation in upload_file.
5. Invoke the vulnerable endpoint: Send an authenticated HTTP POST request to the import_data function endpoint (associated with the infility_import_file class), attaching the spoofed malicious file. The missing capability check allows this action without administrative privileges.
6. Locate and execute the uploaded file: Identify the upload destination path (typically within wp-content/uploads/ or a plugin-specific directory) and send an HTTP GET request to the uploaded PHP shell to achieve remote code execution on the server (Wordfence, Infinitsec).

• Network: Unusual authenticated POST requests to plugin import/upload endpoints (e.g., paths associated with infility_import_file or import_data actions) from low-privilege user accounts; outbound connections from the web server to unknown external IPs following file upload activity.
• File System: Presence of unexpected .php files in WordPress upload directories (e.g., wp-content/uploads/) or within the Infility Global plugin directory; web shell files with names like shell.php, cmd.php, or randomized filenames with PHP extensions.
• Logs: WordPress access logs showing POST requests to plugin import endpoints by subscriber-level users; HTTP 200 responses to newly created PHP files in upload directories; repeated access to the same uploaded file path shortly after upload.
• Process: Unusual child processes spawned by the web server process (e.g., Apache or Nginx spawning bash, curl, wget, or python) indicating web shell execution.

Administrators should immediately update the Infility Global plugin to a version beyond 2.14.42 that addresses the missing capability checks and improper file type validation. As interim mitigations, restrict plugin access to trusted administrative users only, disable open user registration if not required, and deploy a Web Application Firewall (WAF) with rules to block suspicious file upload attempts. Regularly audit uploaded files in wp-content/uploads/ and plugin directories for unexpected PHP files (Wordfence, Wordfence Weekly Report).

Wordfence, the assigning CNA, published the vulnerability in their weekly WordPress vulnerability report for December 8–14, 2025, highlighting it as a notable arbitrary file upload risk (Wordfence Weekly Report). RedPacketSecurity flagged the CVE on social media shortly after disclosure, and CISA included it in a vulnerability bulletin (SB25-349) (CISA Bulletin). No significant broader media coverage or notable researcher commentary beyond standard aggregation has been observed.