CVE-2025-26872CWE-434

WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability

Critical · published May 19, 2025

CVSS v3.1
9.9
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability in Dkszone Eximius could let attackers slip in malicious files without anyone batting an eye! 🔥 Think of it like a pizza restaurant that accepts any type of delivery without checking what's in the box — a delivery driver could bring anything from a pizza to a hazardous package, and if they don’t check, chaos ensues! An attacker could exploit this vulnerability to upload dangerous files, potentially compromising the entire server and exposing sensitive data. This could lead to devastating consequences like ransomware attacks or unauthorized access to critical systems, putting your entire organization at risk.

Put simply

Think of it like a pizza restaurant that accepts any type of delivery without checking what's in the box — a delivery driver could bring anything from a pizza to a hazardous package, and if they don’t check, chaos ensues! This vulnerability allows unrestricted upload of files with dangerous types in Dkszone Eximius, which means malicious files can be executed without proper validation or filtering. The affected versions range from n/a to 2.2, making this a ticking time bomb for users still on these versions.

What to do

An attacker could exploit this vulnerability to upload dangerous files, potentially compromising the entire server and exposing sensitive data. This could lead to devastating consequences like ransomware attacks or unauthorized access to critical systems, putting your entire organization at risk. Immediately update Dkszone Eximius to the latest version to patch this vulnerability. In addition, implement strict validation and filtering for file uploads to ensure only acceptable file types are allowed. Regularly audit your file handling procedures to bolster security. You've got this! With these steps, you'll shield your systems and reclaim your security superhero status! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-05-19T18:04Z
EPSS history
Timeline
  • 19 MAY 18:04Z
    WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability
    cvelistv5