critical9.8
CVE-2025-12057
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing…
Impact
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
Affected products
| Product | Affected versions |
|---|---|
| WavePlayer WordPress Plugin | before 3.8.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.