CVE-2025-9561

🗓️ 03 Oct 2025 11:17:22Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 8 Views

AP Background plugin 3.8.1–3.8.2 lets authenticated subscribers upload arbitrary files due to missing authorization and validation.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-9561	3 Oct 202512:05	–	circl
CNNVD	WordPress plugin AP Background 代码问题漏洞	3 Oct 202500:00	–	cnnvd
CNVD	WordPress AP Background plugin Arbitrary File Upload Vulnerability	13 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-9561 AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function	3 Oct 202511:17	–	cvelist
EUVD	EUVD-2025-32248	3 Oct 202511:17	–	euvd
NVD	CVE-2025-9561	3 Oct 202512:15	–	nvd
Patchstack	WordPress AP Background plugin 3.8.1-3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function vulnerability	3 Oct 202501:14	–	patchstack
Positive Technologies	PT-2025-40497	3 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9561	4 Oct 202511:53	–	redhatcve
Vulnrichment	CVE-2025-9561 AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function	3 Oct 202511:17	–	vulnrichment

Vulners

Node

hovanesvn ap_backgroundRange3.8.1–3.8.2wordpress

[
  {
    "vendor": "hovanesvn",
    "product": "AP Background",
    "versions": [
      {
        "version": "3.8.1",
        "status": "affected",
        "lessThanOrEqual": "3.8.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e4045a2b-2bbc-4335-b6d2-af7a046f1f92
wordpress	www.wordpress.org/plugins/ap-background/

15 Apr 2026 00:35Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

EPSS0.00325

SSVC

CWE-434