CVE-2025-9762: Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the saveattachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9762?
CVE-2025-9762 has a high severity rating as it allows unauthenticated attackers to perform arbitrary file uploads on affected sites.
How do I fix CVE-2025-9762?
To fix CVE-2025-9762, update the Post By Email plugin for WordPress to the latest version that addresses the file upload vulnerability.
Which versions are affected by CVE-2025-9762?
CVE-2025-9762 affects all versions of the Post By Email plugin for WordPress up to and including version 1.0.4b.
What type of attack is CVE-2025-9762 related to?
CVE-2025-9762 is related to an arbitrary file upload attack that can lead to unauthorized access and compromise of the website.
Who can exploit CVE-2025-9762?
CVE-2025-9762 can be exploited by unauthenticated attackers, making it particularly dangerous for unprotected WordPress sites.