CVE-2025-12775: WP Dropzone WordPress Plugin RCE Flaw

CVE-2025-12775 Overview

CVE-2025-12775 is an authenticated arbitrary file upload vulnerability in the WP Dropzone plugin for WordPress. The flaw affects all versions up to and including 1.1.0. The plugin's ajax_upload_handle function performs chunked uploads that write files directly to the WordPress uploads directory before any file type validation occurs. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files, which may lead to remote code execution on the affected server. The issue is classified as [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Subscriber-level users can upload arbitrary files, including PHP scripts, to the WordPress uploads directory, enabling remote code execution.

Affected Products

WP Dropzone plugin for WordPress, versions through 1.1.0
WordPress sites permitting Subscriber registration with the plugin enabled
All deployments where the vulnerable ajax_upload_handle chunked upload handler is reachable

Discovery Timeline

2025-11-18 - CVE-2025-12775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12775

Vulnerability Analysis

The WP Dropzone plugin exposes an AJAX endpoint that handles chunked file uploads from authenticated WordPress users. The handler ajax_upload_handle reassembles uploaded chunks and writes them into the WordPress uploads directory before validating the file type or extension. Because validation occurs after the file already exists on disk, an attacker can write executable content into a web-accessible location.

The vulnerability is reachable by any authenticated user, including the lowest-privileged Subscriber role. WordPress sites that allow open user registration therefore expose this endpoint to any visitor willing to create an account. Successful exploitation provides a foothold for remote code execution, web shell installation, and lateral movement into the underlying host.

The vulnerable code paths can be reviewed in the plugin source at the WP Dropzone class-plugin.php line 88 and line 127.

Root Cause

The root cause is improper ordering of security checks in the chunked upload pipeline. The plugin trusts the chunked upload flow to deliver safe content and defers MIME and extension checks until after the assembled file is written to wp-content/uploads. This violates [CWE-434] by allowing dangerous file types to land in a directory that the web server can execute or directly serve.

Attack Vector

An attacker authenticates to WordPress as a Subscriber, then submits a multi-chunk upload to the plugin's AJAX endpoint with a PHP payload disguised as an allowed media type. The chunks are concatenated into a file at a predictable path under the uploads directory before validation rejects the final extension. The attacker then requests the resulting file directly through the web server to trigger code execution under the PHP-FPM or web server user context. From there, attackers commonly deploy web shells, exfiltrate wp-config.php, or pivot to the database.

No verified public exploit code is available at this time. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12775

Indicators of Compromise

New .php, .phtml, .phar, or other executable script files appearing under wp-content/uploads/ after WP Dropzone upload activity
AJAX POST requests to admin-ajax.php with the WP Dropzone upload action originating from low-privilege accounts
Unexpected outbound connections or system, exec, or shell_exec invocations from the PHP worker process
Newly created WordPress administrator accounts shortly after upload activity from Subscriber sessions

Detection Strategies

Inventory all WordPress sites and identify those running WP Dropzone at version 1.1.0 or earlier
Hash and baseline files in wp-content/uploads/ and alert on the creation of executable extensions
Correlate WordPress audit logs for Subscriber logins followed by admin-ajax.php upload requests and subsequent direct GET requests to the uploaded path
Inspect WAF and reverse-proxy logs for chunked upload requests carrying suspicious magic bytes such as <?php

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server access logs to a centralized analytics platform for retention and correlation
Alert on any process spawned by the web server user that performs shell or network reconnaissance activity
Monitor file integrity on wp-content/ and flag write operations to non-media file types
Track creation of new privileged WordPress users and changes to wp_options site URL values

How to Mitigate CVE-2025-12775

Immediate Actions Required

Update the WP Dropzone plugin to a version later than 1.1.0 as soon as a patched release is available from the maintainer
Disable or uninstall the WP Dropzone plugin on any site where an updated version is not yet available
Audit wp-content/uploads/ for unexpected script files and remove confirmed malicious artifacts
Rotate WordPress administrator credentials, secret keys in wp-config.php, and database passwords if exploitation is suspected

Patch Information

Review the maintainer's commit history through the WordPress Plugin Changeset and the Wordfence Vulnerability Report for current fix status. Upgrade to any version newer than 1.1.0 that explicitly addresses the ajax_upload_handle validation order.

Workarounds

Disable open user registration in WordPress settings to reduce the unauthenticated attack surface
Add a web server rule denying execution of PHP files under wp-content/uploads/ using Apache .htaccess or an Nginx location block
Deploy a WAF rule to block multi-part chunked uploads to admin-ajax.php that carry PHP shebangs or script extensions
Restrict the WP Dropzone capability to higher-privilege roles using a capability management plugin until an official patch is applied

bash

# Nginx: deny PHP execution inside the WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|php8)$ {
    deny all;
    return 403;
}

# Apache: equivalent .htaccess placed in wp-content/uploads/
# <FilesMatch "\.(php|phtml|phar)$">
#     Require all denied
# </FilesMatch>