Tailored Tools: Unauthenticated arbitrary file upload
Summary
The WordPress plugin Tailored Tools up to and including 3.0.3 allows unauthenticated attackers to upload arbitrary files, including PHP files, to the web server. Successful exploitation can lead to takeover of the website and possibly the server. No login is required, but the attack is rated as highly complex. Patchstack rates the issue as high priority and expects exploitation.
Affected
- Tailored Tools WordPress plugin, versions up to and including 3.0.3
Fixed in
- Version 3.0.5 according to the Patchstack advisory.
- Independent confirmation of the fix was not found.
Workaround
- Deactivate and remove the plugin if the site does not need it.
- If it must stay, restrict access to the form and upload functions and apply WAF virtual patching (Patchstack offers a mitigation rule).
- Check the uploads and plugin directories for unexpected files, especially PHP files and files with double extensions.
Exploitation
- No exploitation in the wild was known at the time of research.
- CISA SSVC in the CVE record: exploitation none, automatable no.
- Patchstack describes the vulnerability as expected to become exploited.
- No public proof of concept was found.
Our recommendation
- Identify all WordPress sites with the plugin (version 3.0.3 or older).
- Deactivate and remove the plugin where possible.
- Update to version 3.0.5 or later where the plugin is still needed.
- If an update is not possible, apply WAF virtual patching and file-integrity checks.
- Review recently added administrator accounts and unexpected files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for CVE-2026-62025 patchstack.com
- WordPress.org plugin page: Tailored Tools wordpress.org
- Strix: CVE-2026-62025 www.strix.ai
- OpenCVE: CVE-2026-62025 app.opencve.io
- Vulners: CVE-2026-62025 vulners.com
- HOL Guard: CVE-2026-62025 hol.org
- Patchstack Academy: Arbitrary File Upload patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:14.
Original description (NVD)
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.