CVE-2025-13597 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected**: **AI Feeds** plugin by vendor **soportecibeles**. 📉 **Versions**: **1.0.11 and earlier**. 🌐 **Platform**: WordPress sites running this specific plugin version.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **VERY LOW**. 🔓 **Auth**: **Unauthenticated** (No login required). 🎯 **Config**: Low complexity. Any visitor can exploit this directly via the network.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. 🔗 **PoC Available**: GitHub repo by **d0n601** is public. 🌍 **Wild Exploitation**: High risk due to ease of access and public proof-of-concept.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Scan for **AI Feeds** plugin version ≤ 1.0.11. 2. Check for `actualizador_git.php` endpoint exposure. 3. Use WAF rules to block suspicious file upload attempts to plugin directories.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. 📅 **Patch Date**: Released around **Nov 2025**. 🔗 **Reference**: WordPress Trac changeset **3402321** indicates the fix is available in newer versions.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL / IMMEDIATE ACTION**. ⏳ **Priority**: **P0**. Unauthenticated RCE via file upload is a top-tier threat. Patch or remove the plugin **NOW** to prevent compromise.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical code flaw in the **AI Feeds** WordPress plugin. <br>🔥 **Consequences**: Allows **Arbitrary File Upload**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type). <br>❌ **Flaw**: Missing **capability checks** (authorization/validation) before processing uploads.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: **AI Feeds** plugin by vendor **soportecibeles**. <br>📉 **Versions**: **1.0.11 and earlier**. <br>🌐 **Platform**: WordPress sites running this specific plugin version.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: <br>1️⃣ Upload **Webshells** or backdoors. <br>2️⃣ Execute **Remote Code Execution (RCE)**. <br>3️⃣ Steal sensitive **Database/Data**.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **VERY LOW**. <br>🔓 **Auth**: **Unauthenticated** (No login required). <br>🎯 **Config**: Low complexity. Any visitor can exploit this directly via the network.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. <br>🔗 **PoC Available**: GitHub repo by **d0n601** is public. <br>🌍 **Wild Exploitation**: High risk due to ease of access and public proof-of-concept.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Scan for **AI Feeds** plugin version ≤ 1.0.11. <br>2. Check for `actualizador_git.php` endpoint exposure. <br>3. Use WAF rules to block suspicious file upload attempts to plugin directories.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. <br>📅 **Patch Date**: Released around **Nov 2025**. <br>🔗 **Reference**: WordPress Trac changeset **3402321** indicates the fix is available in newer versions.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Deactivate** and **Delete** the AI Feeds plugin immediately. <br>2. Block upload endpoints via **WAF** or **.htaccess**. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL / IMMEDIATE ACTION**. <br>⏳ **Priority**: **P0**. Unauthenticated RCE via file upload is a top-tier threat. Patch or remove the plugin **NOW** to prevent compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) soportecibeles CWE-434