Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

CIBELES AI plugin allows unauthorized access to WordPress server

CVE-2025-13595 · published 11 months ago
Summary

An attacker can download and change files on a WordPress site using the CIBELES AI plugin, which could lead to unauthorized control of the site. This is a problem for site owners who use the plugin, as it could give attackers the ability to make changes without permission. To protect your site, update the CIBELES AI plugin to the latest version or remove it if you no longer need it.

Original advisory text
The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.10.8. This mak...
The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published25 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-13595 · NVD
Track software like this
Free during beta