Ebook Store: Dangerous file upload

Ebook Store is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Ebook Store
Plugin slug: ebook-store
Affected: See vendor advisory
Safe version: See mitigation notes
Published: Jul 24, 2025
Weakness: CWE-434 — Unrestricted Upload of File with Dangerous Type

This CVE was published Jul 24, 2025 and is one of 15 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Ebook Store to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources