CVE-2025-2006 is a vulnerability in the Inline Image Upload for BBPress plugin for WordPress, affecting all versions up to and including 1.1.19. The issue arises from a lack of validation on file extensions during the upload process, permitting arbitrary file uploads. Authenticated attackers with Subscriber-level permissions or higher can exploit this to upload malicious files to the server, which may lead to remote code execution. Additionally, if the plugin's setting to allow guest users to create topics and replies is enabled, unauthenticated attackers might also exploit this vulnerability. The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type).

Successful exploitation allows attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Both authenticated users with minimal privileges and possibly unauthenticated users (if a specific setting is enabled) can exploit this vulnerability, increasing the risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the 'Allow guest users without accounts to create topics and replies' setting if enabled, to reduce the attack surface. Additionally, restrict file upload permissions and monitor for suspicious uploads. Apply any official updates from the plugin vendor once released.