CVE-2025-11724 is a vulnerability in the EM Beer Manager WordPress plugin (up to version 3.2.3) caused by improper validation of uploaded file types in the EMBM_Admin_Untappd_Import_image() function and lack of authorization checks on the wp_ajax_embm-untappd-import AJAX action. This flaw enables authenticated users with low privileges (subscriber and above) to upload arbitrary files, including executable PHP files, potentially leading to remote code execution if the attacker can provide a mock HTTP server that returns specific JSON data. The CVSS v3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker with minimal privileges to upload and execute arbitrary code on the affected server, compromising confidentiality, integrity, and availability of the system. This could lead to full server compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX action by limiting user roles that can invoke it or disable the plugin if feasible. Monitor for updates from the vendor or trusted security sources for an official patch.