CVE-2025-23953
Published: 22 January 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2025-23953 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Scriptonite User Files WordPress plugin, affecting all versions up to and including 2.4.2. The flaw allows attackers to upload a web shell directly to the web server, bypassing restrictions on dangerous file types.
With a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation grants attackers the ability to upload and execute arbitrary malicious files, such as web shells, enabling full server compromise with high impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/user-files/vulnerability/wordpress-user-files-plugin-2-4-2-arbitrary-file-upload-vulnerability?_s_id=cve details this as an arbitrary file upload issue in the WordPress User Files plugin version 2.4.2, recommending that practitioners update to a patched version or implement mitigations as outlined to prevent exploitation.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability in public-facing WordPress plugin enables direct exploitation (T1190) and arbitrary web shell upload/execution (T1505.003).