{"metadata": {"vulnerability": "CVE-2025-2005", "count": 33, "kinds": {"milestone": 4, "sighting": 20, "kev": 0, "other": 9}}, "data": [{"timestamp": "2025-03-05T21:15:46.177Z", "date_only": false, "value": "2025-03-05T21:15:46.177Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-2005", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-04-01T20:37:06Z", "date_only": false, "value": "2025-04-01T20:37:06.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2025-2005", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2025-04-02T09:21:42.633Z", "date_only": false, "value": "2025-04-02T09:21:42.633Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-2005", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-04-02T09:34:30Z", "date_only": false, "value": "2025-04-02T09:34:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/10046", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "9723adc4-8875-44a9-994a-3a423cb04aec", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2005\n\ud83d\udd25 CVSS Score: 9.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n\ud83d\udccf Published: 2025-04-02T09:21:42.633Z\n\ud83d\udccf Modified: 2025-04-02T09:21:42.633Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/102223a1-07f5-485b-a6af-49cf316d9797?source=cve\n2. https://wordpress.org/support/plugin/front-end-only-users/", "url": "https://t.me/DarkWebInformer_CVEAlerts/10046"}, {"timestamp": "2025-04-02T10:15:19Z", "date_only": false, "value": "2025-04-02T10:15:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W6FF-XGHX-7936", "record": "GHSA-W6FF-XGHX-7936", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-04-02T10:15:19.117Z", "date_only": false, "value": "2025-04-02T10:15:19.117", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2005", "record": "FKIE_CVE-2025-2005", "field": "published"}, {"timestamp": "2025-04-02T10:40:10.762Z", "date_only": false, "value": "2025-04-02T10:40:10.762818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3llt75kfedt2s", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "57ae197d-1ad1-4624-988c-742b13acffb0", "url": "https://bsky.app/profile/cyberalerts.bsky.social/post/3llt75kfedt2s"}, {"timestamp": "2025-04-02T11:00:05Z", "date_only": false, "value": "2025-04-02T11:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/kXZvd58izIQiU_MwCLyFKxklQIm_6IOm5Js_A1mT7KUydck", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "7eea71cb-a54f-41d4-a838-23e167d72231"}, {"timestamp": "2025-04-02T11:48:13.673Z", "date_only": false, "value": "2025-04-02T11:48:13.673368Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114268208686044611", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "98dd19e9-c187-4629-bc62-7f9f656084f5", "url": "https://mastodon.social/users/CyberSignaler/statuses/114268208686044611"}, {"timestamp": "2025-04-02T11:48:13.675Z", "date_only": false, "value": "2025-04-02T11:48:13.675132Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114268208686044611", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "e31e762a-5019-4369-9062-15a75e2ace44", "url": "https://mastodon.social/users/CyberSignaler/statuses/114268208686044611"}, {"timestamp": "2025-04-02T12:06:45.923Z", "date_only": false, "value": "2025-04-02T12:06:45.923492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lltdyemete2n", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "fb0bafa4-868b-4948-b813-f16c37609816", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lltdyemete2n"}, {"timestamp": "2025-04-02T14:58:58Z", "date_only": false, "value": "2025-04-02T14:58:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/21857", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "b48ef13e-4fab-450a-a18c-22bd7f2fc2be", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2005 - WordPress Front End Users Arbitrary File Upload Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2005 \nPublished : April 2, 2025, 10:15 a.m. | 2\u00a0hours, 2\u00a0minutes ago \nDescription : The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"02 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/21857"}, {"timestamp": "2025-04-02T15:31:34Z", "date_only": false, "value": "2025-04-02T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W6FF-XGHX-7936", "record": "GHSA-W6FF-XGHX-7936", "field": "published"}, {"timestamp": "2025-04-02T16:14:19.778Z", "date_only": false, "value": "2025-04-02T16:14:19.778816Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2005", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-04-02T16:14:19.778Z", "date_only": false, "value": "2025-04-02T16:14:19.778816Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2005", "record": "FKIE_CVE-2025-2005", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-02T16:14:39.009Z", "date_only": false, "value": "2025-04-02T16:14:39.009Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-2005", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-03T07:47:35Z", "date_only": false, "value": "2025-04-03T07:47:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/2579", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "08943436-1f2a-41b5-81d2-c5af516c8343", "content": "CVE-2025-2005 WordPress \n*\nFront-End Users Plugin \nVersion Affected: <= 3.2.32\n*\n2 POC Exploit", "url": "https://t.me/proxy_bar/2579"}, {"timestamp": "2025-04-04T01:00:08Z", "date_only": false, "value": "2025-04-04T01:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/aVBd3ldNRLl7Xo5CPtKzp3UErMxRgMRg31wU9VFi81ukDXk", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "890d82df-04c5-4e72-90a6-d51c316f0f58"}, {"timestamp": "2025-04-04T09:02:05Z", "date_only": false, "value": "2025-04-04T09:02:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cybersecplayground/160", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "c961e893-fa5c-46d5-92db-7b41eafab95f", "content": "\ud83d\udea8 Critical 0-Day Alert: CVE-2025-2005 (CVSS 10) \u2013 WordPress Plugin File Upload Vulnerability!\n\nA Critical RCE vulnerability has been discovered in the Front End Users Plugin for WordPress, affecting versions \u2264 3.2.32. This flaw allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the server!\n\n\u2e3b\n\n\u26a0\ufe0f Vulnerability Details:\n \u2022 Plugin: Front End Only Users\n \u2022 Version Affected: \u2264 3.2.32\n \u2022 Impact: Unauthenticated File Upload \u2192 Full Server Takeover\n \u2022 CVSS Score: 10.0 (Critical)\n\n\u2e3b\n\n\ud83d\udd25 Proof of Concept:\n\nPoC available here:\ngithub.com/Nxploited/CVE-\u2026\n\n\u2e3b\n\nFOFA Dork:\n\nbody=\"/wp-content/plugins/front-end-only-users/\"\n\n\u2e3b\n\n\u2705 Recommendation:\n \u2022 Update the plugin immediately or remove it if not in use\n \u2022 Monitor for suspicious uploads and unexpected PHP files\n \u2022 Harden server file permissions and enable WAF rules\n\n\u2e3b\n\nStay ahead of zero-days with us!\nJoin @CyberSecPlayground for exclusive vulnerability alerts, private tools, and real-time bug bounty tips.\n\n\n#CVE2025_2005 #WordPress #Exploit #0day #CyberSecurity #FOFA #OSINT #BugBounty #CyberSecPlayground", "url": "https://t.me/cybersecplayground/160"}, {"timestamp": "2025-04-04T11:37:31Z", "date_only": false, "value": "2025-04-04T11:37:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/MrVGunz/1318", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "40409b36-dd50-4f43-a43c-4275914b17a7", "content": "CVE-2025-2005 WordPress\n*\n\u0627\u0641\u0632\u0648\u0646\u0647 Front-End Users\n*\n\u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631: \u06f3.\u06f2.\u06f3\u06f2 \u0648 \u067e\u0627\u06cc\u06cc\u0646\u200c\u062a\u0631\n*\n\u062f\u0648 \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645\u06cc (PoC) \u0628\u0631\u0627\u06cc \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\n\n\nCVE-2025-2005 WordPress \n*\nFront-End Users Plugin \nVersion Affected: <= 3.2.32\n*\n2 POC Exploit\n\n@MrVGunz", "url": "https://t.me/MrVGunz/1318"}, {"timestamp": "2025-04-04T14:52:16Z", "date_only": false, "value": "2025-04-04T14:52:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dilagrafie/4265", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "815d030d-f237-4d7f-a7ef-736ae69915a9", "content": "WordPress Front End Users Plugin <= 3.2.32 is vulnerable to Arbitrary File Upload.\n\nhttps://github.com/Nxploited/CVE-2025-2005", "url": "https://t.me/dilagrafie/4265"}, {"timestamp": "2025-04-04T21:02:09.968Z", "date_only": false, "value": "2025-04-04T21:02:09.968753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3llzctfjpx32d", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "812ced04-9158-48e6-8687-7b4f3d8153b4", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3llzctfjpx32d"}, {"timestamp": "2025-04-06T18:21:28Z", "date_only": false, "value": "2025-04-06T18:21:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/30164", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "45ca1fd8-1046-4795-8279-72020c915e48", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aWordPress FEUP Arbitrary File Upload Exploit (CVE-2025-2005)\nURL\uff1ahttps://github.com/mrmtwoj/CVE-2025-2005\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/30164"}, {"timestamp": "2025-04-06T23:00:05Z", "date_only": false, "value": "2025-04-06T23:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/5f8moqVvh3k2gjIAjrFuBAFbMIoO7wtT9tjxgSLfNmIi8Mo", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "f3417595-39e3-4a25-8563-2cb29444e73b"}, {"timestamp": "2025-04-07T01:00:08Z", "date_only": false, "value": "2025-04-07T01:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wJJNpcmq9kx21MPfY9-4icgXC2_RjU8KWi9ZvsTo6oz7fwk", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "e5a2ed89-c4b1-45a0-9bac-b4b377ce12e0"}, {"timestamp": "2026-04-08T16:35:54.757Z", "date_only": false, "value": "2026-04-08T16:35:54.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-2005", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-08T16:35:54.757Z", "date_only": false, "value": "2026-04-08T16:35:54.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2025-2005", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-08T18:33:52Z", "date_only": false, "value": "2026-04-08T18:33:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W6FF-XGHX-7936", "record": "GHSA-W6FF-XGHX-7936", "field": "modified"}, {"timestamp": "2026-05-27T05:01:12.897Z", "date_only": false, "value": "2026-05-27T05:01:12.897127Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mmsq23rpnq2g", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "9a9cccf2-10f3-4c71-89ff-f85f599b0b1a", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3mmsq23rpnq2g"}, {"timestamp": "2026-06-17T09:06:03.843Z", "date_only": false, "value": "2026-06-17T09:06:03.843", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-2005", "record": "FKIE_CVE-2025-2005", "field": "lastModified"}, {"timestamp": "2026-07-20T21:00:06.737Z", "date_only": false, "value": "2026-07-20T21:00:06.737249Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/961", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "3a077373-d365-49d7-a95c-55e7f97b5d92", "url": "https://t.me/crackvaultde/961"}, {"timestamp": "2026-07-21T00:00:18.507Z", "date_only": false, "value": "2026-07-21T00:00:18.507371Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/961", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "e202842e-921d-4b36-99bd-dc43dfa68587", "url": "https://t.me/crackvaultde/961"}, {"timestamp": "2026-07-22T00:00:33.655Z", "date_only": false, "value": "2026-07-22T00:00:33.655327Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackvaultde/961", "record": "CVE-2025-2005", "field": "creation_timestamp", "uuid": "b7206728-9526-489d-bdf5-50db6ddec10d", "url": "https://t.me/crackvaultde/961"}]}