CVE-2025-32579

🗓️ 11 Apr 2025 08:42:57Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 60 Views🌐 WEB

Arbitrary file upload vulnerability in WordPress Sync Posts Plugin allows web shell uploads.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2025-32579	14 Apr 202515:11	–	githubexploit
Circl	CVE-2025-32579	11 Apr 202511:48	–	circl
CNNVD	WordPress plugin Sync Posts 代码问题漏洞	11 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-32579 WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability	11 Apr 202508:42	–	cvelist
EUVD	EUVD-2025-10760	3 Oct 202520:07	–	euvd
NVD	CVE-2025-32579	11 Apr 202509:15	–	nvd
Packet Storm News	WordPress SoftClever Limited Sync Posts 1.0 Shell Upload	15 Apr 202500:00	–	packetstormnews
Patchstack	WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability	10 Apr 202507:35	–	patchstack
Positive Technologies	PT-2025-16074 · Softclever Limited · Sync Posts	11 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-32579	13 Apr 202509:32	–	redhatcve

Vulners

Node

softclever_limited sync_postsRange≤1.0wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "sync-posts",
    "product": "Sync Posts",
    "vendor": "SoftClever Limited",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/sync-posts/vulnerability/wordpress-sync-posts-plugin-1-0-arbitrary-file-upload-vulnerability

Parameter	Position	Path	Description	CWE
website_url	request body	wp-admin/admin-ajax.php?action=sync_posts	Unrestricted file upload via Sync Posts plugin allowing authenticated attacker to upload and execute PHP files (RCE).	CWE-434

28 Apr 2026 16:12Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.9

EPSS0.00267

SSVC

CWE-434