CVE-2025-39538

🗓️ 16 Apr 2025 12:45:45Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Vulnerability in WordPress WP-Advanced-Search allows arbitrary file upload of dangerous types.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2025-39538	30 Apr 202517:28	–	githubexploit
Circl	CVE-2025-39538	1 May 202513:00	–	circl
CNNVD	WordPress plugin WP-Advanced-Search 代码问题漏洞	16 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-39538 WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability	16 Apr 202512:45	–	cvelist
EUVD	EUVD-2025-11333	3 Oct 202520:07	–	euvd
NVD	CVE-2025-39538	16 Apr 202513:15	–	nvd
Packet Storm News	WordPress WP-Advanced-Search 3.3.9.3 Shell Upload	1 May 202500:00	–	packetstormnews
Patchstack	WordPress WP-Advanced-Search plugin <= 3.3.9.4 - Arbitrary File Upload Vulnerability	16 Apr 202514:05	–	patchstack
RedhatCVE	CVE-2025-39538	25 Apr 202523:14	–	redhatcve
Vulnrichment	CVE-2025-39538 WordPress WP-Advanced-Search <= 3.3.9.3 - Arbitrary File Upload Vulnerability	16 Apr 202512:45	–	vulnrichment

Vulners

Node

mathieu_chartier wp-advanced-searchRange≤3.3.9.4wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wp-advanced-search",
    "product": "WP-Advanced-Search",
    "vendor": "Mathieu Chartier",
    "versions": [
      {
        "lessThanOrEqual": "3.3.9.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/wp-advanced-search/vulnerability/wordpress-wp-advanced-search-3-3-9-3-arbitrary-file-upload-vulnerability

Parameter	Position	Path	Description	CWE
cmd	query param	wp-content/uploads/2025/04/nxploit.php	Uploaded web shell enables remote command execution via the cmd parameter.	CWE-434

17 Jun 2026 09:18Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.6

EPSS0.0047

SSVC

CWE-434