CVE-2025-13374 is a critical vulnerability in the irisideatechsolutions Kalrav AI Agent WordPress plugin, affecting all versions up to and including 2.3.3. The vulnerability arises from the lack of file type validation in the kalrav_upload_file AJAX action, enabling unauthenticated attackers to upload arbitrary files to the server. This unrestricted file upload can potentially lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or fix details are currently available.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, which may lead to remote code execution on the server hosting the vulnerable plugin. This can result in full system compromise, including data theft, service disruption, and further attacks. The vulnerability affects confidentiality, integrity, and availability with a critical impact rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Kalrav AI Agent plugin to prevent exploitation. Monitoring for updates from irisideatechsolutions is strongly recommended. Avoid exposing the vulnerable AJAX action to unauthenticated users if possible through access controls or web application firewall rules.