WordPress Smart Auto Upload Images plugin <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Dieu Link and GCSC Vietnam in WordPress Plugin Smart Auto Upload Images versions = 1.2.0...

CVE-2025-12161

creationtimestamp| type| source ---|---|--- 2025-11-08 04:32:05+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m53r5v3pyx24 2025-11-08 05:45:38+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m53vbant4sk2 2025-11-08 06:05:21+00:00| seen|...

CVE-2025-12161 Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload

The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and...