CVE-2025-12153 affects the tsaiid Featured Image via URL WordPress plugin, allowing authenticated users with Contributor or higher privileges to upload arbitrary files because the plugin lacks proper file type validation. This unrestricted file upload vulnerability can enable remote code execution on the server hosting the WordPress site. The issue exists in all versions up to and including 0.1. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

An attacker with Contributor-level access or higher can upload arbitrary files to the affected WordPress server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability poses a significant risk to sites using this plugin without mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only or consider disabling the Featured Image via URL plugin to prevent exploitation.