Introduction
Attackers can gain remote code execution on WordPress sites by uploading arbitrary files through the Flex QR Code Generator plugin. The vulnerability, tracked as CVE-2025-10041, affects all plugin versions up to and including 1.2.5. It requires no authentication, which makes it a high risk for any site running the affected software.
Flex QR Code Generator is a third-party WordPress plugin that generates QR codes for content and e-commerce applications. It is distributed through the official WordPress plugin repository and has a moderate user base. WordPress.org closed the plugin on October 14, 2025, after this vulnerability was disclosed.
Technical information
CVE-2025-10041 comes from missing file type validation in the save_qr_code_to_db() function, at line 208 of qr-code-generator.php. The function handles file uploads as part of the QR code generation workflow. Because it does not validate uploads, attackers can upload files with arbitrary extensions and content types, including executable PHP scripts.
An attacker can exploit the vulnerability remotely over the network, with no authentication or special permissions. A crafted HTTP request to the vulnerable endpoint uploads a malicious file to the server. The attacker can then access that file directly through the web server, which gives them remote code execution.
The root cause is that the plugin does not restrict file types or verify file content before it saves an upload. This falls under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable code is visible in the plugin's public source:
Affected systems and versions
- Product: Flex QR Code Generator plugin for WordPress
- Affected versions: All versions up to and including 1.2.5
- Vulnerable in the default configuration
Vendor security history
The plugin is developed by 'ajitdas' (Devs Brain) and distributed through the official WordPress plugin repository. WordPress.org closed the plugin as of October 14, 2025, because of unresolved security issues. There is no evidence that the vendor responded to this vulnerability with a timely patch. No prior information is available about the vendor's security maturity or any history of similar issues.
