External risk intelligence

Flex QR Code Generator WordPress Plugin Arbitrary File Upload

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12673

This vulnerability exists in a WordPress plugin. WordPress sites are web applications commonly deployed as public-facing services. The vulnerability allows unauthenticated file uploads, and because the plugin is designed to process user-provided content on the web server, it is likely to be reachable via the public internet in standard deployments.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Flex QR Code Generator plugin for WordPress, which could allow unauthorized users to upload malicious files to a website's server. This could potentially lead to the execution of harmful code, impacting the integrity and availability of online services. The main concern is confirming if this plugin is in use and identifying any potential exposure.

Uploading files can allow server compromise.
Unauthenticated access poses a significant risk.
Confirm usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files to a WordPress site by exploiting a weakness in the Flex QR Code Generator plugin. This could allow them to execute malicious code on the server, potentially compromising the entire site.

No authentication required.
Upload files via vulnerable function.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload arbitrary files to a WordPress site's server by exploiting a flaw in the Flex QR Code Generator plugin. When supported, this could lead to the execution of malicious code on the server.

Arbitrary files could be uploaded to the server.
File upload occurs via a flawed update function.
Remote code execution may be possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Flex QR Code Generator plugin's vulnerability impacts WordPress site owners and administrators. The immediate first step is to locate all instances of this plugin across your WordPress deployments, confirm their reachability, and identify the accountable owner responsible for the site and its plugins. Subsequent actions will depend on this assessment and existing maintenance schedules or vendor coordination.

Site administrators or application owners.
Confirm plugin presence and accessibility.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Flex QR Code Generator plugin?

It is a WordPress plugin designed to create QR codes for website content. Users typically install it to allow visitors to quickly scan and access links, contact information, or other data directly from a page. Because it is a web-based tool, it processes data inputs that interact with the server hosting the WordPress site.

What does CWE-434 mean for CVE-2025-12673?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this CVE, the plugin fails to check what kind of file a user is uploading. Instead of only accepting images or data files, the system allows almost any file to be saved to the server. If an attacker uploads a script disguised as a valid file, the server might mistakenly run it.

How does an attacker trigger this vulnerability?

An attacker targets the update_qr_code() function within the plugin. They do not need to log in or have administrative rights to reach this part of the code. The bug is not triggered by standard, legitimate use of QR generation; it requires the attacker to specifically send a malicious file request to the server that the plugin then fails to block or sanitize.

Is my site at risk?

If you use the Flex QR Code Generator, you should assume risk. According to Halo Surface Signal, this plugin is typically deployed on public-facing web servers. Since the flaw allows for unauthenticated uploads, any site using this plugin that is reachable via the internet provides a potential path for an attacker to interact with the vulnerable function.

What should I do if I use this plugin?

First, identify every WordPress site in your environment where this plugin is installed. Once you have a list of affected sites, confirm which ones are active and reachable. Determine who is responsible for managing these sites so you can coordinate the next steps for disabling or updating the plugin according to your organization's maintenance procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.