The vulnerability CVE-2025-23968 affects the WebFactory AiBud WP plugin up to version 1.9. It allows an attacker with high privileges to upload files of dangerous types without restriction, including web shells, to the web server. This can lead to complete compromise of the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and scope change with high impact on all security properties.

Successful exploitation of this vulnerability allows an attacker with high privileges to upload and execute arbitrary code on the web server via a web shell. This can result in full system compromise, including data theft, modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin functionality to trusted users only and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.