CVE-2025-22504

CVE-2025-22504 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the 4ECPS Web Forms WordPress plugin by jumpdemand. This issue affects all versions of the 4ecps-webforms plugin up to and including 0.2.18, enabling attackers to upload a web shell directly to the web server.

The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required, while changing scope to achieve high impacts across confidentiality, integrity, and availability. Unauthenticated attackers can leverage this flaw to upload malicious files, such as web shells, potentially resulting in arbitrary code execution and full server compromise.

Patchstack's advisory documents this as an arbitrary file upload vulnerability specifically in 4ECPS Web Forms plugin version 0.2.18, available at https://patchstack.com/database/Wordpress/Plugin/4ecps-webforms/vulnerability/wordpress-4ecps-web-forms-plugin-0-2-18-arbitrary-file-upload-vulnerability?_s_id=cve. Security practitioners should consult this reference for detailed mitigation steps.