CVE-2025-2005

CVE-2025-2005 is a critical arbitrary file upload vulnerability affecting the Front End Users plugin for WordPress, specifically in versions up to and including 3.2.32. This flaw allows unauthenticated attackers to upload malicious files due to missing file type validation in the registration form, potentially leading to remote code execution. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, enabling complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.