CVE-2025-39538
CVSS 3.1 Score 6.6 of 10 (medium)
Details
Published Apr 16, 2025
CWE ID 434
Summary
CVE-2025-39538 is a critical vulnerability affecting WP-Advanced-Search versions 3.3.9.3 and earlier. The issue involves an Unrestricted File Upload vulnerability, which enables attackers to upload a malicious web shell to a web server. This can result in unauthorized access, data theft, or server takeover. The vulnerability occurs because the plugin fails to restrict the types of files that can be uploaded, making it possible for dangerous files to bypass security checks and potentially cause significant damage.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.