CVE-2025-12835

High · 7.3

CVSS

7.3

EPSS

0.3%

Published

Dec 12, 2025

CISA due date

—

The record

The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.

Affected packages

Ecosystem	Package	Introduced	Fixed