{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awedevswp_user_frontend_prowordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wedevs:wp_user_frontend_pro:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2025-3054"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP User Frontend Pro (\u003c= 4.1.3)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","rce","file-upload","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe WP User Frontend Pro plugin for WordPress, specifically versions up to and including 4.1.3, contains a vulnerability that allows for arbitrary file uploads. This flaw resides in the upload_files function and requires the \u0026quot;Private Message\u0026quot; module to be enabled within the Business edition of the software. An authenticated attacker with at least Subscriber-level privileges can leverage this to upload malicious files, potentially leading to remote code execution. At the time of reporting, no official patch is documented.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution on the server hosting the WordPress instance. This vulnerability is restricted to environments where the \u0026quot;Private Message\u0026quot; module is active in the Business version of the plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress environments to determine if the WP User Frontend Pro plugin is installed and running version 4.1.3 or earlier.\u003c/li\u003e\n\u003cli\u003eDisable the \u0026quot;Private Message\u0026quot; module within the WP User Frontend Pro plugin configuration as a temporary mitigation until an official patch is released.\u003c/li\u003e\n\u003cli\u003eReview WordPress access logs for anomalous file upload attempts by users with \u0026quot;Subscriber\u0026quot; roles or higher.\u003c/li\u003e\n\u003cli\u003eMonitor the web server document root for newly created files with suspicious extensions (e.g., .php, .php5, .phtml) uploaded via the plugin's path.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T02:03:18Z","date_published":"2026-10-24T02:03:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-3054-rce/","summary":"The WP User Frontend Pro WordPress plugin is vulnerable to arbitrary file upload via the upload_files function, allowing authenticated attackers to achieve remote code execution.","title":"WP User Frontend Pro: Arbitrary file upload remote code execution (CVE-2025-3054)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-3054-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wedevs:wp_user_frontend_pro:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}