External risk intelligence

Case Addons Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-62047

This vulnerability affects a WordPress plugin. WordPress plugins are commonly used to extend the functionality of public-facing websites and web applications. As such, the vulnerable code path is typically reachable via the internet as part of the standard deployment of a web-based service.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Case Addons plugin for WordPress, identified as CVE-2025-62047. The issue relates to unrestricted file uploads, which, if exploited, could allow an attacker to upload malicious files to a website. Given its critical severity, understanding the potential impact and confirming its relevance to our environment is important.

Malicious file uploads can compromise website security.
Critical flaw in a widely used website plugin.
Verify if Case Addons plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker with low-privilege access could upload a dangerous file through the Case Addons plugin. This could allow them to execute arbitrary code on the server, leading to a complete compromise of the system.

Requires low-privilege access.
Upload a dangerous file via the plugin.
Leads to full server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to upload malicious files to the affected WordPress site. When supported by the advisory's conditions, this could lead to the compromise of the server hosting the website.

Server files at risk.
Malicious file upload.
Potential server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Case Addons plugin for WordPress, likely impacting public-facing websites and web applications. The first step for system owners and security teams is to identify all instances of this plugin, determine their exposure and criticality, and locate the accountable application or platform owner. A risk-based remediation plan should then be developed, potentially involving vendor coordination or temporary risk reduction measures until a permanent fix can be applied during a planned maintenance window.

Identify and confirm affected systems.
Verify exposure and business criticality.
Coordinate vendor fix or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Case Addons plugin for WordPress?

Case Addons is a software extension used with the WordPress platform to introduce specialized features or design elements to a website. By integrating this plugin, site administrators can enhance their site's functionality beyond core WordPress capabilities. However, because it runs within the WordPress environment, it becomes part of the server-side code execution path, meaning any flaws within the plugin directly impact the security of the host website.

What does an Unrestricted Upload of File with Dangerous Type mean for CVE-2025-62047?

This vulnerability, classified as CWE-434, refers to a failure in the plugin to properly validate or filter the files users upload to the server. Instead of checking for safe file types, the software allows any file to be saved to the system. This weakness creates a bridge for an attacker to upload executable files, which the server might then run, effectively granting unauthorized control over the website's backend processes.

How does an attacker trigger this file upload vulnerability?

The flaw is triggered when an attacker uses the plugin's upload functionality to submit a malicious file. This process requires the attacker to have at least a low-privilege user account on the WordPress site. Importantly, the vulnerability is not triggered by simply visiting the site or interacting with public content; it specifically requires the ability to reach and interact with the file upload interface provided by the plugin.

Why should I care about CVE-2025-62047 if my site is online?

Halo Surface Signal indicates that WordPress plugins are integral to public-facing websites, making the vulnerable code path easily reachable over the internet. If your WordPress instance is accessible to the public, the risk is higher because the entry point for this flaw exists within the standard, exposed functionality of your web application, potentially allowing unauthorized remote access to your server infrastructure.

Do I need to check my WordPress site for this plugin?

Yes, your first step is to confirm whether the Case Addons plugin is installed and active on your systems. Start by listing all plugins in your WordPress environment to identify versions earlier than 1.3.0. Once identified, map those instances to their specific business functions to determine their criticality. Use this inventory to prioritize maintenance and coordinate with your team to apply vendor-provided updates as soon as they become available.

References

patchstack.com/database/Wordpress/Plugin/case-addons/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.