Improper File Type Handling in Bulk User Import in Auth0 Wordpress plugin CVE-2025-58769 - Oct 1, 2025

Description

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Affected versions

You are affected if you meet the following preconditions:

Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.3.0,
Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 Wordpress plugin to version 5.4.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for their discovery.

CVE details

CVE ID	CVE-2025-58769
Published Date	2025-10-01
Vulnerability Type	Unrestricted File Upload
CWE	CWE-434 - Unrestricted Upload of File with Dangerous Type
CVSS v3	Score: 3.3 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

Improper File Type Handling in Bulk User Import in Auth0 Wordpress plugin