CVE-2025-12154: Auto Thumbnailer WordPress RCE Vulnerability

CVE-2025-12154 Overview

The Auto Thumbnailer plugin for WordPress contains an arbitrary file upload vulnerability in the uploadThumb() function. The flaw affects all versions up to and including 1.0. Missing file type validation allows authenticated attackers with Contributor-level access or higher to upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected site. The weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated Contributor-level attackers can upload arbitrary files via uploadThumb(), enabling potential remote code execution against the WordPress host.

Affected Products

WordPress Auto Thumbnailer plugin versions up to and including 1.0
WordPress sites granting Contributor-level or higher access to untrusted users
Hosting environments executing PHP files uploaded to the WordPress uploads directory

Discovery Timeline

2025-12-05 - CVE-2025-12154 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12154

Vulnerability Analysis

The Auto Thumbnailer plugin exposes an uploadThumb() function that accepts file uploads without validating the file type or extension. WordPress exposes this endpoint to any authenticated user holding the Contributor role or higher. Attackers can submit a crafted multipart request containing a PHP payload disguised as a thumbnail image. Once written to the uploads directory, the file can be requested directly from the web server, triggering code execution under the web server user context.

The attack surface is reachable over the network and requires no user interaction. The vulnerability impacts confidentiality, integrity, and availability of the WordPress host. EPSS data indicates a probability of 0.219% at the 44.6 percentile as of 2026-06-09.

Root Cause

The uploadThumb() function omits server-side checks on MIME type, file extension, and file magic bytes. WordPress core functions such as wp_check_filetype_and_ext() are not invoked, and there is no allowlist of permitted extensions. As a result, executable file types such as .php, .phtml, or .phar pass through the handler unchecked.

Attack Vector

An attacker authenticates to WordPress using any account with Contributor privileges or above. The attacker then invokes the plugin's upload endpoint with a POST request containing a PHP webshell. After the file lands in the wp-content/uploads directory, the attacker requests the file via HTTP to execute the embedded code. This grants command execution on the underlying server.

No public proof-of-concept exploit is currently listed for this CVE. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Overview.

Detection Methods for CVE-2025-12154

Indicators of Compromise

New executable files such as .php, .phtml, .phar, or .htaccess written under wp-content/uploads/ paths owned by the Auto Thumbnailer plugin
HTTP POST requests to plugin upload handlers originating from Contributor-level accounts followed by GET requests to uploaded files
Outbound connections from the PHP-FPM or web server process to attacker-controlled infrastructure shortly after upload activity
Newly created WordPress users in the Contributor role that subsequently invoke plugin upload endpoints

Detection Strategies

Inspect WordPress access logs for POST requests targeting Auto Thumbnailer endpoints, correlating with the requesting user's role
Scan the uploads directory for files with executable extensions or PHP code embedded in image files
Monitor file integrity on wp-content/uploads/ and alert on creation of any non-media file types

Monitoring Recommendations

Enable verbose authentication logging for low-privilege WordPress roles and forward events to a centralized SIEM
Alert on web server processes spawning shells (sh, bash, python) or network utilities (curl, wget)
Track creation of new Contributor or Author accounts across managed WordPress sites for anomalous patterns

How to Mitigate CVE-2025-12154

Immediate Actions Required

Deactivate and remove the Auto Thumbnailer plugin until a patched release is available from the vendor
Audit all Contributor and higher accounts and reset credentials for any account showing suspicious upload activity
Inspect the wp-content/uploads/ tree for unauthorized PHP files and remove any artifacts

Patch Information

No vendor patch is referenced in the available advisory data. The plugin is vulnerable in all versions up to and including 1.0. Site operators should monitor the WordPress Plugin Overview page for updates and remove the plugin in the interim.

Workarounds

Restrict the Contributor and Author roles to trusted users only, or disable self-registration on WordPress sites running this plugin
Configure the web server to deny PHP execution within the wp-content/uploads/ directory using directives such as php_flag engine off or equivalent Nginx location rules
Place a web application firewall in front of the WordPress instance and block multipart uploads containing PHP tags or suspicious extensions

bash

# Configuration example: disable PHP execution in WordPress uploads (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>