The vulnerability CVE-2025-47452 affects the RexTheme WP VR WordPress plugin up to version 8.5.26. It allows an attacker with at least low privileges (PR:L) and no user interaction (UI:N) to upload files of dangerous types without restriction. This can include web shells, enabling remote code execution and full system compromise. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L). The impact includes complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H). No patch or official fix details are currently available.

Successful exploitation allows an attacker to upload arbitrary files, including web shells, to the web server hosting the WP VR plugin. This can lead to remote code execution, full system compromise, data theft, data modification, and denial of service. The CVSS score of 9.9 reflects the critical nature of these impacts. There are no known exploits in the wild currently, but the vulnerability poses a severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the vulnerable plugin if possible, and monitor for suspicious activity related to file uploads. Avoid exposing the plugin to untrusted users. Follow vendor communications closely for updates on patches or official mitigations.