CVE-2025-69129: WordPress Scraper File Upload Vulnerability

CVE-2025-69129 Overview

CVE-2025-69129 is an unauthenticated arbitrary file upload vulnerability in the WordPress & WooCommerce Scraper Plugin, Import Data from Any Site, affecting versions through 1.0.7. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Remote attackers can upload arbitrary files to a vulnerable WordPress site without authentication, leading to remote code execution under the web server context. The issue carries a CVSS 3.1 base score of 10.0 with a scope change, indicating that successful exploitation impacts resources beyond the plugin itself.

Critical Impact
Unauthenticated attackers can upload executable files to a vulnerable WordPress site, enabling full server compromise, data theft, and lateral movement into adjacent WooCommerce assets.

Affected Products

WordPress & WooCommerce Scraper Plugin, Import Data from Any Site (wp_scraper) versions <= 1.0.7
WordPress sites with the affected plugin installed and active
WooCommerce storefronts relying on the plugin for product import

Discovery Timeline

2026-06-17 - CVE-2025-69129 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-69129

Vulnerability Analysis

The plugin exposes a file upload handler that fails to validate file type, extension, or authentication state before writing user-supplied content to disk. An unauthenticated attacker reaches the upload endpoint over HTTP and submits a crafted multipart request containing a PHP payload. WordPress then serves that payload from a web-accessible directory, allowing the attacker to execute arbitrary code as the web server user.

Because the request requires no privileges and no user interaction, the vulnerability is trivially weaponizable through automated scanners. The scope change in the CVSS vector reflects that code execution within the WordPress process can pivot to adjacent components, including the database, file system, and any integrated WooCommerce payment or customer data.

The EPSS score is 0.358% at the 27.5 percentile as of the latest scoring date, but EPSS lags rapid weaponization of unauthenticated WordPress upload flaws.

Root Cause

The plugin lacks two mandatory controls on its upload handler. First, it does not enforce a capability check such as current_user_can('manage_options') or a valid WordPress nonce, which leaves the endpoint reachable by anonymous users. Second, it does not whitelist permitted MIME types or extensions before persisting uploads. The combination allows direct placement of .php files into a web-accessible directory.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a single HTTP POST request to the vulnerable plugin endpoint with a webshell as the upload payload. The server writes the file under wp-content/uploads/ or a plugin-controlled directory, and the attacker requests the file directly to trigger execution. Refer to the Patchstack Vulnerability Report for endpoint-level details.

Detection Methods for CVE-2025-69129

Indicators of Compromise

New PHP files in wp-content/uploads/ or plugin-managed directories with recent modification timestamps and unexpected ownership.
Outbound connections from the WordPress host to attacker-controlled infrastructure following an upload event.
HTTP POST requests to plugin endpoints from anonymous sources with Content-Type: multipart/form-data and .php, .phtml, or double-extension filenames.
Newly created WordPress administrator accounts or modified wp-config.php entries after a suspicious upload.

Detection Strategies

Hunt web server access logs for POST requests targeting the wp_scraper plugin path returning HTTP 200 with no prior authenticated session.
Apply file integrity monitoring to wp-content/ to flag the creation of executable file types in upload directories.
Inspect WAF telemetry for multipart uploads where the filename or MIME indicates server-side script content.

Monitoring Recommendations

Forward Apache, Nginx, and PHP-FPM logs to a centralized analytics platform and alert on php execution from uploads paths.
Continuously enumerate installed WordPress plugins and versions to identify hosts running wp_scraper <= 1.0.7.
Monitor process creation on WordPress hosts for shell utilities (sh, bash, python, wget, curl) spawned by the web server user.

How to Mitigate CVE-2025-69129

Immediate Actions Required

Deactivate and remove the WordPress & WooCommerce Scraper Plugin from all affected sites until a fixed version is confirmed available.
Audit wp-content/uploads/ and plugin directories for unauthorized PHP files and remove any unrecognized artifacts.
Rotate WordPress administrator passwords, API keys, and database credentials on any host that ran the vulnerable plugin.
Review WordPress user tables for newly added administrative accounts and revoke them.

Patch Information

No vendor-supplied patched version is referenced in the available advisory data. Monitor the Patchstack Vulnerability Report for the official fix and upgrade once a release above 1.0.7 is published.

Workarounds

Block the plugin's upload endpoint at the web application firewall until a patch is installed.
Enforce a server-level rule that denies execution of PHP files inside wp-content/uploads/ using an Nginx location block or Apache <Directory> directive.
Restrict outbound traffic from the WordPress host to a known allowlist to limit webshell command-and-control.
Require authentication and a valid nonce at the reverse proxy for any request reaching plugin administration paths.

bash

# Nginx: deny PHP execution under WordPress uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache: equivalent control in .htaccess inside wp-content/uploads/
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>