{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3054", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-31T19:17:08.251Z", "datePublished": "2025-06-05T05:23:00.228Z", "dateUpdated": "2026-04-08T17:10:42.803Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:42.803Z"}, "affected": [{"vendor": "wedevs", "product": "WP User Frontend Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use."}], "title": "WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve"}, {"url": "https://headwayapp.co/wp-user-frontend-changelog"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-06-04T16:33:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-05T13:18:35.182475Z", "id": "CVE-2025-3054", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-05T14:08:06.826Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-05T13:18:35.182475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-05T13:18:36.651Z"}}], "cna": {"title": "WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wedevs", "product": "WP User Frontend Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-04T16:33:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve"}, {"url": "https://headwayapp.co/wp-user-frontend-changelog"}], "descriptions": [{"lang": "en", "value": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:42.803Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3054", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:42.803Z", "dateReserved": "2025-03-31T19:17:08.251Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-05T05:23:00.228Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this requires the 'Private Message' module to be enabled and the Business version of the PRO software to be in use."}, {"lang": "es", "value": "El complemento WP User Frontend Pro para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n upload_files() en todas las versiones hasta la 4.1.3 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo. Tenga en cuenta que esto requiere que el m\u00f3dulo \"Mensaje privado\" est\u00e9 habilitado y que se utilice la versi\u00f3n Business del software PRO."}], "id": "CVE-2025-3054", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-05T06:15:25.833", "references": [{"source": "security@wordfence.com", "url": "https://headwayapp.co/wp-user-frontend-changelog"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:27:27.660972+00:00", "value": {"mitigation_remediation": ["Update WP User Frontend Pro to version 4.1.4 or newer", "Disable the Private Message module if the Business edition is not required", "Restrict Publisher and higher administrative roles to trusted users only"], "summary": {"action": "Apply Patch", "impact": "Arbitrary file upload with potential remote code execution"}, "threat_synthesis": {"affected_systems": "The issue affects the WordPress plugin WP User Frontend Pro provided by WeDevs, versions 4.1.3 and earlier. Administrators who have deployed the Private Message module and are using the Business version of the plugin are at risk. The vulnerability applies only to installations that have at least Subscriber\u2010level user authentication configured, irrespective of the WordPress core version.", "description_and_impact": "The vulnerability resides in the upload_files() function of the WP User Frontend Pro plugin, which fails to enforce file type validation. An authenticated user with Subscriber access or higher can upload any file to the server when the Private Message module is active and the Business edition of the PRO software is in use. Successful exploitation can lead to arbitrary code execution, allowing an attacker to compromise the entire WordPress installation, exfiltrate data, install backdoors, or disrupt services.", "risk_and_exploitability": "The moderate CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of 1% suggests a low to moderate probability that the flaw will be actively exploited, and the vulnerability is not currently listed in the CISA KEV catalog. Attacks would require legitimate user credentials and the appropriate module configuration, mitigating the risk of widespread, automated exploitation, but still representing a significant threat to any affected site."}}}}, "created": "2026-04-21T20:30:27.402446+00:00", "updated": "2026-04-21T20:30:27.402455+00:00", "vendors": []}