---
id: CVE-2025-12563
title: >-
  The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is
  vulnerable to limited file upload due to an incorrect capability check on
  theuploadVideo() function in all versions up to, and including, 8.6.0
summary: >-
  The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is
  vulnerable to limited file upload due to an incorrect capability check on
  theuploadVideo() function in all versions up to, and including, 8.6.0. This
  makes it po…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
published: '2025-11-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12563'
references:
  - url: 'https://plugins.trac.wordpress.org/changeset/3389636/blog2social'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/3710f139-0f17-426c-b48c-4c42ae4bab5f?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00195
epssPercentile: 0.09165
ingestedAt: '2026-10-01T18:55:42.302Z'
---

## Overview

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.