CVE-2025-12057

This flaw is like a door lock that doesn’t require a key. If someone finds it, they may be able to drop their own files onto your website’s server, which can then be turned into full control of the server or used to cause damage.

This matters if you run the WordPress plugin WavePlayer and your installed version is earlier than 3.8.0. Because the issue is unauthenticated, an attacker can try it without having an account.

It’s a direct risk when the vulnerable plugin is reachable on your public WordPress site (i.e., the affected AJAX feature is accessible over the internet with no login).

This is RED because there is a public exploit available, meaning attackers can attempt the attack in the real world. In addition, the issue has sustained attention consistent with active or repeatable incidents.

Do not wait for symptoms—treat it as an urgent patching task if you use a vulnerable WavePlayer version.