PT-2025-51062

CVE-2025-13094

·

Published

2025-12-12

·

Updated

2025-12-18

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WP3D Model Import Viewer plugin for WordPress versions through 1.0.7
Description The WP3D Model Import Viewer plugin for WordPress is susceptible to arbitrary file uploads. This is due to a lack of file type validation within the handle import file() function. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution.
Recommendations Update to version 1.0.8.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2025-13094
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com