Elastic Theme Editor <= 0.0.3 - Téléchargement arbitraire de fichiers (Subscriber+) authentifié

The primary impact of CVE-2025-12637 is the ability for an authenticated attacker to upload arbitrary files to the WordPress server. This is a significant security risk because uploaded files could contain malicious code, such as web shells or backdoors. Successful exploitation could grant the attacker complete control over the affected WordPress site, allowing them to modify content, steal sensitive data, or even use the server as a launchpad for further attacks. The dynamic code generation flaw in the process_theme function is the root cause, enabling this unauthorized file upload capability.

WordPress sites utilizing the Elastic Theme Editor plugin, particularly those with Subscriber-level users or higher, are at risk. Shared hosting environments where users have limited control over server configurations are also particularly vulnerable, as they may be unable to implement granular file upload restrictions.

• wordpress / composer / npm:

wp plugin list | grep Elastic Theme Editor

• wordpress / composer / npm:

wp plugin update --all

• wordpress / composer / npm:

grep -r 'process_theme' /var/www/html/wp-content/plugins/elastic-theme-editor/

• generic web: Check WordPress plugin directory for updates and security advisories related to Elastic Theme Editor.

1. 2025-11-11Disclosure

   disclosure

1. Réservé2025-11-03
2. Publiée2025-11-11
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The immediate mitigation for CVE-2025-12637 is to upgrade the Elastic Theme Editor plugin to a patched version as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, restrict file upload permissions on the server to prevent unauthorized file uploads. Review and harden WordPress file upload security settings, including file type restrictions and size limits. Monitor WordPress logs for suspicious file upload activity.