CVE-2025-12673 is an unrestricted file upload vulnerability in the Flex QR Code Generator plugin for WordPress, specifically in the update_qr_code() function. The plugin fails to validate file types before upload, allowing attackers without authentication to upload arbitrary files. This can lead to remote code execution on the server hosting the vulnerable plugin. The vulnerability affects all versions up to and including 1.2.7. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's upload functionality if possible and monitor for suspicious file uploads. Avoid using the affected plugin versions in production environments.