CVE-2025-22654 CRITICAL

CVE-2025-22654: WordPress Simplified Plugin Plugin <= 1.0.6 - Arbitrary File Upload vulnerability

Vendor Kodeshpa
Product Simplified
Weakness CWE-434 · Unrestricted file upload
Published February 18, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: from n/a through <= 1.0.6.

Explanation of Vulnerability in Simple Terms

02Summary

Kodeshpa Simplified versions 1.0.6 and earlier allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files to the server over the network without needing to log in or interact with a user. This can lead to complete compromise of the site, including data theft, site defacement, and malware installation.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the server without authentication and execute arbitrary code.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can steal data, deface content, install malware, or take full control.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

February 18, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-58349 WordPress Theme Travelscape 1.0.3 Arbitrary File Upload CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key CVE-2026-5411 WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 CVE-2026-2354 Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()