CVE-2025-12528 is an arbitrary file upload vulnerability in the Pie Forms — Drag & Drop Form Builder WordPress plugin by genetechproducts. The issue arises from the format_classic function where the validate_classic method only validates file extensions and sets error messages but does not prevent the upload from proceeding. This allows unauthenticated attackers to upload files with dangerous extensions like PHP. The uploaded file's directory is a somewhat predictable hash, and the file name is generated using a secure hash method, which reduces but does not eliminate the risk of exploitation. The vulnerability affects all versions up to and including 1.6 and has a CVSS 3.1 score of 8.1 (high severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, potentially leading to remote code execution on the affected server. This compromises confidentiality, integrity, and availability of the system running the vulnerable plugin. However, the need to guess the upload directory and the secure hash-based file naming limits the ease of exploitation.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for suspicious file uploads and restricting web server execution permissions in upload directories may help mitigate risk.