Read the docs
TI-2019-15241 Aliases CVE-2019-25138GHSA-wrjq-6j55-j564

User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 53CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02326 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed User Submitted Posts – Enable Users to Submit Posts from the Front End (specialk): 20190426

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
specialkUser Submitted Posts – Enable Users to Submit Posts from the Front Endbefore 2019042620190426Patch availableCNA
  • User Submitted Posts – Enable Users to Submit Posts from the Front End Vendorspecialk Affected before 20190426 Fixed in 20190426 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plugin-planet:user_submitted_posts:*:*:*:*:*:wordpress:*:*up to 20190312Vulnerablespecialk
  • cpe:2.3:a:plugin-planet:user_submitted_posts:*:*:*:*:*:wordpress:*:* Versions up to 20190312 Vulnerable ·specialk

Remediation

  • Fix · CNA User Submitted Posts – Enable Users to Submit Posts from the Front End (specialk) Fixed in 20190426

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25138
  2. 2026-10-03 Alias added: GHSA-wrjq-6j55-j564

References

Exploit 1

Advisory 1

Other 1

  • TI-2024-04645 User Submitted Posts < 20240516 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2023-24406 WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-03982 User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' CVSS 3.1HIGH 7.2
  • TI-2016-09039 The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. CVSS 3.1MEDIUM 6.1
  • TI-2023-04406 Cross-site scripting in specialk User Submitted Posts – Enable Users to Submit Posts from… CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences