External risk intelligence

WavePlayer WordPress Plugin Arbitrary File Upload Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12057

The vulnerability exists in a WordPress plugin. WordPress sites are typically deployed as public-facing web applications, making the plugin's AJAX endpoints commonly accessible from the internet.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the WavePlayer WordPress plugin that could allow unauthorized users to upload malicious files and execute code on a server. The issue arises from a lack of proper authorization and file validation within the plugin's functionalities.

Unauthenticated users could upload files and run code.
Critical flaw could impact website integrity and availability.
Confirm relevance and assess exposure to this plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by interacting with a vulnerable WordPress site that has the affected plugin installed. Since no authentication is required, an unauthenticated user can trigger the vulnerability. This allows an attacker to upload an arbitrary file to the server, which can then be used to achieve remote code execution.

No authentication needed to start.
Triggered by an AJAX action.
Leads to arbitrary file upload and RCE.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated users could upload arbitrary files to the server, potentially leading to remote code execution. This is possible when the WavePlayer WordPress plugin is used and certain conditions are met, allowing an attacker to gain control over the affected server.

Arbitrary file upload on server.
Exploiting unauthenticated AJAX actions.
Potential for remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are responsible for managing WordPress plugins, including the WavePlayer plugin. The first step is to identify all WordPress sites, confirm exposure and business criticality, and then ascertain the specific owner of each affected instance. Remediation planning should follow based on this inventory and risk assessment.

Application owners should own the issue.
Verify all WordPress site exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WavePlayer WordPress plugin?

WavePlayer is a WordPress plugin designed to add audio playback capabilities to websites. It allows site administrators to embed audio files, such as music or podcasts, for visitors to listen to directly within their browsers. It functions as a specialized media management tool that integrates with the standard WordPress media library and post editor.

What does CWE-434 mean regarding CVE-2025-12057?

CWE-434 identifies a weakness where an application allows the upload of files without sufficient validation. In the context of CVE-2025-12057, the plugin fails to check the type or content of uploaded files and lacks access controls on specific functions. This allows unauthorized parties to place arbitrary files on the web server, which is the necessary first step toward achieving remote code execution.

How is the CVE-2025-12057 vulnerability triggered?

The flaw is triggered by interacting with an unprotected AJAX endpoint within the plugin. An attacker sends a crafted request to this endpoint to initiate the file upload process. Importantly, the vulnerability does not require legitimate user credentials or administrative access to trigger; the absence of authorization checks means any network request to that specific action can initiate the process.

Why is this CVE concerning for my WordPress site?

Halo Surface Signal notes that because WordPress sites are typically public-facing web applications, the plugin's AJAX endpoints are usually accessible from the internet. This makes it possible for external actors to reach the vulnerable code. If your site uses an affected version, it is likely reachable by anyone on the web, increasing the risk of unauthorized server interaction.

Do I need to check my installations for CVE-2025-12057?

Yes. First, create an inventory of all WordPress sites you manage to identify where the WavePlayer plugin is active. Once you have a list of sites running the plugin, determine which ones are version 3.7.9 or older. Prioritize these instances for remediation, ensuring that you coordinate with the appropriate application owners to mitigate the risk of remote code execution.

References

wpscan.com/vulnerability/110db433-01ec-47ea-b74f-c3faa1757a3c/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.