CVE-2025-11889 is a CWE-434 vulnerability in the AIO Forms – Craft Complex Forms Easily WordPress plugin by edgarrojas. The flaw exists because the plugin fails to validate file types during the import process, allowing authenticated users with Administrator privileges to upload arbitrary files. This can potentially enable remote code execution on the server hosting the WordPress site. The vulnerability affects all versions up to 1.3.18. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its underlying server environment. The vulnerability poses a significant risk if exploited, especially in environments where administrative access is not tightly controlled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and consider disabling or limiting the import functionality in the plugin. Monitor for updates from the plugin vendor and apply patches promptly once available.