CVE-2025-2005 is a critical vulnerability in the Front End Users WordPress plugin by rustaurius. The issue stems from the lack of file type validation in the file upload field of the registration form, allowing unauthenticated attackers to upload arbitrary files. This can lead to remote code execution on the web server hosting the vulnerable plugin. The vulnerability affects all versions up to 3.2.32. There is no vendor advisory or patch information available at this time. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin. The high CVSS score (9.8) reflects the critical nature of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict file upload functionality in the Front End Users plugin or implement additional file type validation controls at the web server or application level to prevent arbitrary file uploads.