CVE-2025-23918
Published: 22 January 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2025-23918 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Smallerik File Browser WordPress plugin developed by Enrico Sandoli. The flaw affects all versions from n/a through 1.1 and enables attackers to upload web shells directly to the web server. It carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, and potential for high-impact compromise across confidentiality, integrity, and availability.
Low-privileged users, such as authenticated WordPress contributors (PR:L), can exploit this vulnerability remotely over the network without requiring user interaction. By uploading malicious files like web shells, attackers achieve scope change (S:C) and full control over the server, enabling arbitrary code execution, data exfiltration, or further persistence.
Patchstack advisories document this as an arbitrary file upload vulnerability specifically in Smallerik File Browser plugin version 1.1 for WordPress, providing details on the issue for mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows unrestricted upload of dangerous files (web shells) in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190) and deployment of web shells (T1100) for code execution and persistence.