CVE-2025-7437 is a critical vulnerability in the motovnet Ebook Store WordPress plugin caused by the lack of file type validation in the ebook_store_save_form function. This flaw permits unauthenticated attackers to upload arbitrary files, which could lead to remote code execution on the affected server. The vulnerability affects all versions up to and including 5.8012. The CVSS 3.1 score of 9.8 reflects the high impact on confidentiality, integrity, and availability. No patch or official fix is currently available, and no exploits have been observed in the wild. Users should monitor vendor advisories for updates.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable plugin, which may enable remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Ebook Store plugin to prevent exploitation. Implementing web application firewall (WAF) rules to block suspicious file uploads may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.