CVE-2025-26892

🗓️ 19 May 2025 18:06:06Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 46 Views🌐 WEB

Unrestricted file upload vulnerability in Celestial Aura allows malicious file usage, affects 2.2.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for CVE-2025-26892	9 Jun 202523:30	–	githubexploit
Circl	CVE-2025-26892	10 Jun 202503:00	–	circl
CNNVD	WordPress plugin Celestial Aura 代码问题漏洞	19 May 202500:00	–	cnnvd
Cvelist	CVE-2025-26892 WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability	19 May 202518:06	–	cvelist
EUVD	EUVD-2025-27729	3 Oct 202520:07	–	euvd
NVD	CVE-2025-26892	19 May 202518:15	–	nvd
Packet Storm News	WordPress Celestial Aura Theme 2.2 Shell Upload	10 Jun 202500:00	–	packetstormnews
Patchstack	WordPress Celestial Aura Theme <= 2.2 is vulnerable to Arbitrary File Upload	14 Apr 202500:00	–	patchstack
Patchstack	WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability	14 Apr 202513:30	–	patchstack
Positive Technologies	PT-2025-22056 · Dkszone · Celestial Aura	19 May 202500:00	–	ptsecurity

Vulners

Node

dkszone celestial_auraRange≤2.2wordpress

[
  {
    "collectionURL": "https://wordpress.org/themes",
    "defaultStatus": "unaffected",
    "packageName": "celestial-aura",
    "product": "Celestial Aura",
    "vendor": "dkszone",
    "versions": [
      {
        "lessThanOrEqual": "2.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/wordpress/theme/celestial-aura/vulnerability/wordpress-celestial-aura-plugin-2-2-arbitrary-file-upload-vulnerability

Parameter	Position	Path	Description	CWE
CA_hdrimage	request body	wp-admin/admin.php?page=CA-settings	Unrestricted File Upload in Celestial Aura allows authenticated users to upload PHP files via the settings page.	CWE-434

28 Apr 2026 19:29Current

8.6High risk

Vulners AI Score8.6

CVSS 3.19.9

EPSS0.00412

SSVC

CWE-434