2.0.2
CVE-2025-11087 is an Arbitrary File Access vulnerability affecting the Zegen Core WordPress plugin. This vulnerability allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. The issue impacts versions 0.0.0 through 2.0.1 and has been resolved in version 2.0.2.
The primary impact of CVE-2025-11087 is the ability for an attacker to upload arbitrary files to the WordPress server. This is achieved through a Cross-Site Request Forgery (CSRF) attack exploiting missing nonce validation and inadequate file type validation within the /custom-font-code/custom-fonts-uploads.php file. Successful exploitation could allow an attacker to upload malicious web shells, backdoors, or other executable code, granting them complete control over the affected WordPress site. The blast radius extends to the entire server if the uploaded code can be leveraged to compromise the underlying system. This vulnerability shares similarities with other file upload vulnerabilities where insufficient validation allows for the execution of attacker-controlled code.
CVE-2025-11087 was publicly disclosed on 2025-11-21. The vulnerability's severity is considered HIGH due to the potential for remote code execution. No public proof-of-concept (PoC) code has been publicly released as of the disclosure date, but the ease of exploitation via CSRF suggests a moderate probability of exploitation. It is not currently listed on the CISA KEV catalog.
WordPress sites utilizing the Zegen Core plugin, particularly those with weak CSRF protection or shared hosting environments where file permissions are less restrictive, are at significant risk. Sites with outdated versions of WordPress or plugins that have not been regularly updated are also more vulnerable.
• wordpress / composer / npm:
grep -r 'custom-fonts-uploads.php' /var/www/html/• wordpress / composer / npm:
wp plugin list | grep Zegen Core• wordpress / composer / npm:
wp plugin update Zegen Core• generic web:
Check server logs for suspicious POST requests to /custom-font-code/custom-fonts-uploads.php with unusual file extensions.
disclosure
漏洞利用状态
EPSS
0.09% (25% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-11087 is to immediately upgrade the Zegen Core plugin to version 2.0.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to /custom-font-code/custom-fonts-uploads.php that lack proper authentication or contain suspicious file extensions. Additionally, review and restrict file upload permissions on the server to limit the potential damage from a successful exploit. Carefully examine WordPress user roles and permissions to minimize the impact of a compromised administrator account. After upgrading, verify the fix by attempting a file upload with a known malicious extension (e.g., .php) to ensure it is blocked.
更新至 2.0.2 版本，或更新的补丁版本
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-11087 is a HIGH severity vulnerability in the Zegen Core WordPress plugin allowing attackers to upload arbitrary files via CSRF, potentially leading to remote code execution.
You are affected if you are using Zegen Core plugin versions 0.0.0 through 2.0.1. Upgrade to 2.0.2 or later to mitigate the risk.
Upgrade the Zegen Core plugin to version 2.0.2 or later. As a temporary workaround, implement a WAF rule to block suspicious requests to the vulnerable endpoint.
While no public exploits are currently known, the ease of exploitation via CSRF suggests a moderate probability of exploitation.
Refer to the official Zegen Core plugin documentation and WordPress security announcements for updates and advisories related to CVE-2025-11087.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。