Introduction
Attackers can gain remote code execution on WordPress sites by sending a crafted email with a malicious attachment. The cause is a critical flaw in the Post By Email plugin, which automates post creation from email. The plugin is a third-party extension for WordPress, a content management system powering over 40 percent of the web. The core WordPress team does not maintain it, and it is less widely used than the major plugins, but its functionality appeals to organizations that automate content workflows.
Technical Information
CVE-2025-9762 is an arbitrary file upload vulnerability in the Post By Email plugin for WordPress, present in all versions up to and including 1.0.4b. The root cause is missing file type validation in the save_attachments function, located in class-post-by-email.php at line 702 (reference).
When the plugin receives an email with attachments, it processes the attachments and saves them to the server. WordPress's built-in media upload checks file types and extensions, but the plugin's custom logic does not validate the file type, extension, or content. An unauthenticated attacker can therefore send an email with an arbitrary file attached, such as a PHP script, and the plugin will save it to the server, often in a web-accessible directory. If the attacker uploads a PHP file and then requests it over the web, they can achieve remote code execution.
The vulnerability is classified under CWE-78 (OS Command Injection) because a malicious script, once uploaded and executed, can run arbitrary commands. The attack needs no authentication and no prior access to the WordPress site. Any site where the plugin is active and configured to process incoming emails is exploitable.
As of the publication date, there is no official patch or fixed version. The only effective mitigation is to remove or deactivate the plugin.
Affected Systems and Versions
- Product: Post By Email plugin for WordPress
- Affected versions: All versions up to and including 1.0.4b
- Vulnerable configurations: Any WordPress installation with the Post By Email plugin active and configured to process incoming emails
Vendor Security History
- The Post By Email plugin has had previous security issues, including a reflected XSS vulnerability (Patchstack advisory).
- A small team maintains the plugin, and it does not have a strong track record of rapid security response or regular updates.
