Loading vulnerability…
CVE-2025-12057 is an unauthenticated arbitrary file upload vulnerability in the WavePlayer plugin for WordPress affecting versions prior to 3.8.0. The flaw is caused by missing authorization checks in an AJAX action and insufficient validation of the file being copied locally. Available reporting indicates the vulnerable functionality is the plugin action used to create a local copy of a file, identified as waveplayer_create_local_copy. An attacker can invoke this functionality without authentication and cause the application to place attacker-controlled executable content into a server-accessible upload location, resulting in remote code execution when the uploaded payload is requested or otherwise executed by the web server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit PoC for CVE-2025-12057 affecting the WordPress WavePlayer plugin before 3.8.0. It contains two files: `README.md`, which explains the vulnerability and operator workflow, and `wave.py`, the actual exploit script. The script is not part of a larger framework. `wave.py` is the main entry point and implements a multithreaded scanner/exploit tool. It reads a text file of target WordPress site URLs, prompts the operator for an attacker-controlled payload URL, and then processes targets concurrently using Python threads and a queue. For each target, it first performs a GET request to the site root and attempts to extract a usable nonce from page content using several regex patterns (`ajax_nonce`, `nonce`, `_nonce`, `security`, `wpnonce`, and `nonce=`). If a nonce is found, it sends a POST request to `/?wvpl-ajax=create_local_copy` with form data containing the nonce and the attacker-supplied remote payload URL. If the server returns JSON with `success: true`, the script treats the target as vulnerable and extracts `data.track.temp_file`, which appears to be the uploaded file path/URL, then appends it to `shells.txt`. The exploit capability is unauthenticated remote file upload leading to RCE, assuming the vulnerable plugin endpoint will fetch and store a remote PHP file. The README explicitly describes using a PHP webshell payload and a helper `loader.php` to ensure the payload is served with a PHP content type. This makes the repository more than a detector: it actively attempts exploitation and records resulting shell locations. The code uses `requests`, disables TLS verification, retries failed requests, and sets a browser-like User-Agent. Overall, this is an operational PoC scanner/exploit for bulk targeting of WordPress sites running vulnerable WavePlayer versions.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A WavePlayer vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
Vulnerability in the WavePlayer WordPress plugin listed by the alert as being exploited in a large-scale CMS exploitation campaign.
A publicly known and patched vulnerability affecting the WavePlayer WordPress plugin that is being exploited in a large-scale CMS campaign to deploy webshells.
A vulnerability affecting WavePlayer for WordPress, mentioned as part of a broader ACSC list of CMS/plugin vulnerabilities targeted in a global exploitation campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.