CVE-2018-25335 | WordPress Plugin Peugeot Music 1.0 contains an arbitrary fil… | CVSS 9.8 CRITICAL

Description

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to execute code from the uploads directory.

Metadata

CVE ID: CVE-2018-25335
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-05-17 11:56 UTC
Published: 2026-05-17 12:11 UTC
Last updated: 2026-05-18 14:27 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: peugeot-music-plugin / Peugeot Music
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
peugeot-music-plugin	Peugeot Music	—	1.0

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

ExploitDB-44737 https://www.exploit-db.com/exploits/44737
VulnCheck Advisory: WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload https://www.vulncheck.com/advisories/wordpress-plugin-peugeot-music-arbitrary-file-upload