Critical severity9.8NVD Advisory· Published Nov 19, 2025· Updated Jun 17, 2026
CVE-2025-12057
CVE-2025-12057
Description
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<3.8.0+ 1 more
- (no CPE)range: <3.8.0
- (no CPE)range: <3.8.0
Patches
Vulnerability mechanics
References
1News mentions
3- iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-DaysThe Hacker News · Jul 13, 2026
- Australia warns of global campaign targeting vulnerable CMS platformsBleepingComputer · Jul 11, 2026
- Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress SitesThe Hacker News · Jul 10, 2026