CVE-2025-23968: webfactory aibud wp
CVSS: 9.1v3.1CriticalDeferred
Published 03-07-2025Last modified 12-05-2026
Vulnerability summary
CVE-2025-23968 is a critical (CVSS 9.1) vulnerability in webfactory aibud wp. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.4% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.50%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-07-2025PublishedVulnerability first disclosed.
- 12-05-2026Last modifiedVulnerability information updated.
Description
Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through <= 1.9.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSources3 sources · 8.1–9.1
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- wordfenceSource8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.07 pp
From 0.43% on 19-09-2026
19-09-202619-10-2026
EPSS score0.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Affected systems
Wordpress2 products
- aibuddy-openai-chatgpt≤ 1.8.5
- graphina-elementor-charts-and-graphs≤ 3.1.1 (fixed in 3.1.2)
Webfactory1 product
- aibud wp≤ 1.9
2 vendors · 3 products
References
3 links- patchstack.com/database/…VDB Entry